Scribehow

We’ve reviewed the recent advisory concerning compromised Axios versions on npm and can confirm that we were not impacted. Scribe does not leverage Axios in our application stack. Scribe services were not exposed to the malicious packages. We will continue to monitor our supply chain as supply chain attacks emerge and can confirm we are not impacted.

We are aware of the Shai-Hulud 2.0 npm supply chain attack, in which malicious versions of certain open-source packages were published and used to exfiltrate secrets and spread across parts of the npm ecosystem. Following a comprehensive review, we confirmed that Scribe was not impacted by this incident. Our team validated that our code repositories, dependency chains, and build processes are free from the malicious packages associated with this attack. As part of this assessment: - We examined all dependency manifests and verified that none reference the affected packages or versions. - We reviewed system logs and security telemetry and found no indicators of compromise or suspicious activity related to this campaign. We will continue monitoring industry guidance and threat intelligence for any evolving indicators related to Shai-Hulud 2.0 or similar supply chain risks. If new information emerges, we will update this notice promptly in alignment with our incident response procedures.

We’re excited to share that Scribe has successfully completed our 2025 SOC 2 Type II audit with zero exceptions. This milestone reflects our ongoing commitment to keeping your data secure and maintaining the highest standards of compliance. You can count on Scribe to continue investing in the trust, transparency, and protection you expect from us every day.

Scribe has successfully completed our 2024 SOC 2 Type II audit. This report demonstrates our commitment to the security of our systems and your data. We engaged an independent third party to review evidence of our controls. We received no exceptions on our report, meaning our auditors found that we have successfully implemented controls to achieve our goal of security of our systems and your data. The report is now available for download via the Trust Center.

It is our team's goal to make your information security reviews as seamless as possible through our commitment to transparency with our customers and users. To that end, we've launched our AI Security & Privacy Webpage, where you will find all information relevant to our use of AI, how your data interacts with AI, and what we do to protect your data. https://scribehow.com/legal/ai-security