How DataScope protects your account and the files you upload, and the few habits on your side that make the biggest difference.
No passwords to leak
DataScope does not use passwords. You sign in with a 6-digit code sent to your email address. Each code works once, expires 10 minutes after it is sent, and stops working after 5 wrong attempts. Codes are stored only as a one-way hash.
The practical consequence: your DataScope account is exactly as safe as your email inbox. If you protect one thing, protect that. Turn on two-step verification with your email provider.
Your session
Once you are signed in, your session lives in a secure, HTTP-only cookie that page scripts cannot read. The whole site is served over HTTPS only. If you use a shared computer, sign out when you are done.
API keys: treat them like passwords
An API key is shown to you once, when you create it, and DataScope stores only a hash of it. That means two things:
- Copy it somewhere safe immediately. It cannot be shown again.
- If it leaks, revoke it. Create a new key from Dashboard → Settings → API and delete the old one.
Never paste a key into a public repository, a shared document or a chat. Keep it in an environment variable on the machine that calls the API.
Who sees your files
Files you upload and the instructions you write are used to run your analysis and any expert review you ask for. A specialist only sees a project when you assign one to it through Expert Touch, and you are not put in direct contact with them.
Upload only what the question needs
The safest data is data you never uploaded. Before you export a file, remove columns the analysis does not need:
- Names, emails and phone numbers rarely matter for a trend. A customer ID does the same job.
- Free-text notes can contain anything. Drop them unless the notes are what you want analysed.
- Exact dates of birth can usually become an age band.
DataScope is not built for health data. Do not upload it.
Closing your account
If you stop using DataScope, you can ask for your account to be closed. Your data is kept for 30 days after closure, so you can change your mind, and is then deleted. The Cancellation Policy has the details.