ScopeMantle is SOC 2 Type II in progress, read our trust commitments →

ScopeMantle

For CISOs

The control you don't have, until you have us.

Continuous audit of every third-party OAuth grant, a risk score on every vendor, and the workflows to revoke, deprovision, and (soon) prevent. So the next Context.ai doesn't walk into your Workspace.

Book a demoRead the threat model
●scopemantle.app/executive/risk
ScopeMantleExecutiveRisk overview
Q2 2026 · all sources

Apps inventoried

847

+18 this week

Critical exposure

12

2 net new · 30d

High risk

48

-7 vs. last quarter

Open gaps

9

3 awaiting policy

Severity distribution · 847 apps

847APPS
  • Critical12
  • High48
  • Medium203
  • Low584
High+Critical · 12 weeks -12%

Top apps by risk

  • Replit12u · 14sCritical
  • Zapier67u · 21sHigh
  • Mixpanel86u · 9sHigh
  • Anthropic Console41u · 3sMedium
  • Loom312u · 7sMedium
3 open gaps awaiting policy

Replit · Zapier · Mixpanel hold Gmail send scope without review rule.

WHAT KEEPS YOU UP AT NIGHT

Three sentences. One platform.

Problem

"I cannot name the third parties with live access to our data."

ScopeMantle

Neither can most of your peers. Avg 847. Reviewed: 12.

Problem

"After the last breach headline, the board asked me 'could that happen to us?' I didn't have a good answer."

ScopeMantle

You will, after one connection.

Problem

"We pay an ITDR tool, an SSPM, a CASB, and a TPRM vendor. None of them owns the OAuth layer."

ScopeMantle

That's the whole point of this category.

CASE STUDY

How a ScopeMantle-equipped org would have seen the Context.ai → Vercel chain.

  1. T+0

    Employee installs Context.ai

    Grants 'Allow All' on Google Workspace from a personal-looking consent screen. No IT review. No SSO gate.

  2. T+5m

    ScopeMantle detects new OAuth grant

    Event stream emits a new-grant alert. Scopes: gmail.readonly + drive.readonly + calendar. Vendor has no SOC 2.

  3. T+15mCritical

    Vendor Risk Score computed: 27/100

    Scope Sanity 4/20, vendor asking for scopes far beyond stated function. Security 8/40. Privacy 11/30. Breach History 4/10.

  4. T+1hResolved

    Pre-configured policy fires

    Rule: 'Auto-revoke new grants from unreviewed vendors with Score < 40.' Token revoked. Incident logged to SIEM and Slack.

●scopemantle.app/vendors/context-ai
ScopeMantlePrivacy IntelligenceNotion
Claude Opus 4

Notion · privacy posture

notion.so/privacy
Last refreshed: 18 Apr 2026Doc revision: 2025-11-04Source pages parsed: 7
Data categories collected
94%

Identity · Communications · File contents · Behavioral telemetry

Sub-processors disclosed
97%

AWS (us-east-1, eu-west-1) · Stripe · Datadog · Twilio · Snowflake

Cross-border transfers
88%

EU → US under SCCs (2021/914) · UK IDTA · No data transferred to China

Retention windows
79%

Account data: 30d post-cancellation · Logs: 12 months · Backups: 35 days

Notification SLA (incident)
91%

72 hours from confirmed breach (Article 33-aligned)

Extracted facts are evidence-linked back to the source URL · re-runs monthly or on policy change detection

This is not a hypothetical. This is how ScopeMantle already works for our design-partner cohort. The Vercel case is public. The next one will be too.

WHAT SCOPEMANTLE DOES FOR CISOS

Six controls. One identity connection.

  • Continuous inventory of every OAuth grant, every scope
  • LLM-driven vendor risk scoring on the long tail
  • Policy-driven revocation and stale-token sweep
  • Board-ready risk reports, exportable monthly
  • SIEM / SOAR integration for your existing SOC workflow
  • Evidence-on-demand for SEC disclosure, SOC 2, DORA

IN THE FIELD

How design-partner CISOs use ScopeMantle.

“We finally have a number to put in the board pack.”

Within a week of connecting Okta, this team had a defensible quarterly figure for high-risk OAuth grants and a trend line going down. The board stopped asking 'how many?' and started asking 'what's next?'

— CISO, Series-D fintech (design partner)
“Our SIEM finally sees what our identity stack sees.”

Normalized OAuth-grant events flow into Splunk on a documented schema. Detection rules written once apply across every connector, no per-source parsing, no broken queries when a connector ships an update.

— Director of Security, healthtech (design partner)
“We retired our annual third-party review project.”

When the inventory is continuous and policy is enforced, the annual review becomes a quarterly attestation that the controls are still on. The team got eight weeks back.

— Head of GRC, mid-market SaaS (design partner)

CAPABILITIES FOR CISOs

The capabilities security leaders live in.

OAuth Audit

Continuous inventory of every OAuth grant, every scope, every user, across Okta + Google Workspace.

Read more

Vendor Risk Scoring

LLM-driven posture scoring on every vendor, including the long-tail that manual TPRM tools miss.

Read more

Govern & Revoke

Policy engine that revokes risky tokens, requires approval for new installs, alerts on scope escalation.

Read more

Event Stream

Normalized events to Splunk, Datadog, Elastic, Sumo Logic, and a documented JSON contract.

Read more

FAQ

Frequently asked by CISOs.

Don't see your question? Talk to sales →

Bring your test tenant. We'll show you your actual third-party footprint, live, in under 10 minutes.

Book a 30-minute working session with a ScopeMantle engineer. Bring your Okta or Google Workspace test tenant.

Book the working session

Find the Context.ai in your org before the attacker does.

15-minute connection. First inventory in an hour. Vendor risk scores for every third party by tomorrow.

Book a 30-minute demoTalk to sales

Book a demo to see the inventory on your own tenant.