How Winston Scout is secured and operated.

Scout runs in Azure UK South as separate web, API and ingestion-worker services on Azure Container Apps. The worker has no public ingress. Azure Database for PostgreSQL stores application data, Key Vault supplies secrets and Application Insights receives operational telemetry.

The public Winston Intelligence website is a separate static application. It links to Scout but does not receive Scout session cookies, API credentials or product secrets.

Local-account passwords are hashed. A successful sign-in creates a signed one-hour access token held in a host-only, HTTP-only cookie; in production the cookie is also Secure and SameSite=Lax. Microsoft Entra ID tokens can be accepted when that sign-in route is configured.

Choosing “Keep me signed in” creates a separate 30-day opaque credential. Scout stores only its SHA-256 digest, and sign-out, password change, expiry or account suspension can revoke it. The browser does not receive either credential through JavaScript or local storage.

Every workspace-specific API operation checks membership on the server. Actions restricted to an Owner or Admin also check that role; a workspace or user identifier supplied by the browser is not accepted as proof of access.

The browser talks to Scout through the Next.js web service rather than calling the API cross-origin. Production Swagger is disabled. The web and API services send baseline security headers for transport security, framing, content-type handling and referrer policy.

The API rate-limits authentication, public search and signed-in workflow writes. Scout registration and the Winston launch-notification form also require server-verified Cloudflare Turnstile evidence for the expected action and hostname before they create an account, store an address or send e-mail.

Scout retains raw public procurement payloads before transformation. Normalised fields and source identifiers are stored without overwriting the source values. Saved searches, buyer follows, tags, notes, exports and supplier profiles are workspace-scoped, with user attribution where the workflow records it. Personal account details, notification choices and theme preference are user-scoped.

AI-generated notice summaries are stored separately from source and normalised data and are visibly labelled in Scout. The ingestion worker sends only stored public notice facts for generation; it does not send workspace notes, tags or saved searches. The web page reads the stored summary instead of generating one during a visit.

Scout Free has no checkout and does not collect payment details.

Application Insights and Log Analytics collect service telemetry under stable web, API and worker roles. Azure Monitor rules watch API error spikes, application restarts, worker silence, source freshness and normalisation, e-mail retry/dead-letter events, aggregate e-mail delivery failures, billing-webhook failures and PostgreSQL resource pressure. Application logs do not record recipient addresses, verification tokens or recovery links.

Production secrets are configuration, not source code. Azure services reach Key Vault through a managed identity, and application connections to PostgreSQL require TLS.

PostgreSQL automated backups are retained for seven days. Geo-redundant backup is not enabled. This page describes controls in the current service; it is not an external certification or an independent assurance report.