// Trust & Security Report
Scalenut Inc.
AI-powered SEO / GEO (Generative Engine Optimization) content platform: article writer, content optimizer, content audit, AI visibility tracker, GEO Action Center, Social UpReach (Reddit engagement), and a Backlinks Marketplace, sold both self-serve (DIY software) and as an expert-managed done-for-you service.
Certifications held
1
Maturity
Growth
Trains on your data
Unknown
Trust center
No
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on scalenut.com“This Privacy Policy shall be in compliance with the General Data Protection Regulation (GDPR) in effect from May 25, 2018”
> Show 7 unconfirmed / not-held certifications
source: scalenut.comNo public evidence. No SOC 2 mention found on scalenut.com homepage, privacy policy, terms and conditions, pricing page, or about page; no vendor-hosted trust center exists (trust.scalenut.com does not resolve).
source: scalenut.comNo public evidence. Not mentioned anywhere on scalenut.com; a third-party aggregator (Nudge Security) lists an 'ISO 27001 Compliant' badge with no audit report, certificate ID, or link, which does not meet the vendor-domain proof bar.
source: scalenut.comNo public evidence. Scalenut's own blog content (e.g. its healthcare/dental SEO articles) discusses the general importance of HIPAA compliance for its customers' industries, but Scalenut does not claim HIPAA compliance for its own platform anywhere on its domain.
source: scalenut.comNo public evidence on scalenut.com. Payment processing is not described on the site; no PCI claim appears on any vendor page checked.
source: scalenut.comNo public evidence. FedRAMP authorization is granted only to a small, published list of vendors selling to US federal agencies; Scalenut, a content-marketing SEO tool, does not appear on scalenut.com to make this claim, and no vendor-domain proof exists.
source: scalenut.comNo public evidence on scalenut.com or any vendor-controlled page.
source: scalenut.comNo public evidence. No AI-governance certification is mentioned anywhere on the vendor domain.
// Privacy & AI training
Trains on customer data
Not stated
Data processing agreement
Not offered
Data region
Not disclosed on any vendor page reviewed (no data-residency or regional-hosting statement found in privacy policy, terms, or about page).
No vendor-domain page states plainly whether customer content is used to train Scalenut's or a third-party's AI models. Terms and Conditions authorize the company to 'use, store or otherwise process certain personal information and all published Content ... for personalization of Services, marketing and promotional purposes and for optimisation of User-related options and Services' - broad enough to cover training/optimization uses but not an explicit training statement, and no opt-out mechanism or tier-based distinction is described. Treat as unconfirmed pending direct vendor confirmation.
// Security controls
Encryption in transit / at rest
Only a generic, non-specific claim: 'We employ many different security techniques to protect such data from unauthorized access ... We follow generally accepted industry standards.' Privacy policy explicitly disclaims guarantees: 'no security system is impenetrable ... cannot guarantee the security of our database.' No detail on TLS versions, at-rest encryption, or key management.
scalenut.comData Processing Agreement (DPA)
Not found on the vendor domain; no self-serve DPA page, download, or signature flow located.
scalenut.comTrust center / security documentation
None. No dedicated security/trust page exists on scalenut.com; trust.scalenut.com does not resolve (DNS failure).
scalenut.comSSO / enterprise access controls
Not mentioned on the public pricing page or elsewhere on the vendor domain.
scalenut.com// Products & data scope
data: User account data, published content, keyword/topic research inputs, brand-mention and AI-visibility tracking data
Core self-serve platform: topic discovery, content automation, GEO scoring, content optimizer, internal linking, AI visibility tracker.
data: Same as DIY plus direct engagement with Scalenut staff who create and manage content and strategy on the customer's behalf
Involves human Scalenut personnel handling customer brand/content strategy directly, a materially different trust boundary than the self-serve software.
data: Site and domain data used to broker backlink placements with third-party sites
Involves third-party publisher relationships outside Scalenut's direct infrastructure.
data: Reddit account/engagement data
Automates engagement on a third-party platform (Reddit); no separate data-handling disclosure found.
// What to watch
- Third-party sites (e.g. Nudge Security's security-profile page) and generic AI web-search summarization present Scalenut as SOC 2, ISO 27001, HIPAA, PCI, GDPR, FedRAMP, and CSA STAR Level 1 compliant, but none of these claims are backed by any vendor-domain page, certificate, or audit reference - this reads as an aggregator-generated badge list rather than a verified vendor disclosure and should not be treated as fact without direct vendor confirmation.
- No vendor-operated trust center exists; trust.scalenut.com does not resolve, which is unusual for a company that markets itself to '1M+ businesses' including enterprise-track buyers.
- No DPA available on the vendor domain, which is a gap for any customer needing GDPR Article 28 contractual coverage.
- AI-training posture on customer content is not explicitly disclosed; Terms language is broad enough to permit content use for 'optimisation of Services' but does not clearly state whether this includes AI model training, and no opt-out is described.
- No data-residency/region statement found anywhere on the vendor domain.
// At a glance
Pricing model
Tiered SaaS subscription (self-serve DIY plans) plus custom-quoted managed/expert services and backlink marketplace transactions; specific price points not captured in this review.
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Scalenut Inc.'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-09. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
scalenut.com