Security
Encrypted, private, and exportable.
Your business data runs everything you do, so we protect it with real controls.
Your data, your rules.
01
Data and encryption.
- In transitTLS 1.2+ (HTTPS) on every connection, with modern ciphers.
- At restConnected-mailbox credentials are encrypted with AES-256-GCM. Database storage is access-controlled on dedicated hardware, not separately encrypted.
- IsolationEach workspace's data is logically separated; queries are always scoped to your workspace.
- BackupsAutomated nightly backups, encrypted before they leave the server, kept 14 days, mirrored the same night to a second, independent host that keeps 30, and copied off-site.
02
Access and identity.
Control who gets in, and exactly what they can do.
- Two-factor authAvailable on every plan for every user.
- Roles & permissionsRole-based access, with advanced granular permissions on Growth.
- Audit logPer-record history on every plan; the workspace audit log — deletions, exports, role and settings changes — on Growth.
- Not available todaySSO/SAML, SCIM provisioning and IP allowlisting are not built. We'd rather say so than sell you one.
03
Infrastructure and reliability.
- HostingSpodus Cloud runs on dedicated Hetzner infrastructure in Nuremberg, Germany, fronted by Cloudflare for DNS, TLS and DDoS protection.
- Backups & recoveryNightly encrypted backups mirrored to a second host and copied off-site, with a documented restore procedure. Recovery point is the last nightly run, so up to 24 hours of changes could be lost.
- Data locationAll Spodus Cloud data is stored in Germany, inside the EU. We don't offer other regions today, and we'd rather say so than sell you one.
Sub-processors.
Every third party that touches your data, named, with what it does and where it runs.
| Provider | Purpose | Location | Certifications |
|---|---|---|---|
| Hetzner Online GmbH | Application hosting, database and backups | Nuremberg, Germany | ISO 27001:2022, PCI DSS 4.0 |
| Cloudflare, Inc. | DNS, CDN, TLS termination, DDoS protection, object storage for uploaded files (R2), and encrypted off-site copies of database backups (R2) | Global edge network | SOC 2 Type II, ISO 27001, ISO 27701, PCI DSS Level 1 |
| Stripe, Inc. | Payment processing for Spodus subscriptions | United States | PCI DSS Level 1, SOC 2 Type II |
| Resend (Plus Five Five, Inc.) | Transactional and notification email | United States | SOC 2 Type II |
| Google LLC | OAuth sign-in and Google Calendar sync, only for a workspace that connects a Google account | United States | ISO 27001, SOC 2 Type II, SOC 3 |
| Microsoft Corporation | Microsoft Entra OAuth and Outlook/Graph calendar sync, only for a workspace that connects a Microsoft account | United States | ISO 27001, SOC 2 Type II |
| Anthropic, PBC | AI assistant model provider (only the records a user asks the assistant about) | United States | SOC 2 Type II |
| OpenAI, L.L.C. | AI assistant model provider (only the records a user asks the assistant about) | United States | SOC 2 Type II |
Certifications listed are held by each provider, not by Spodus. See the full sub-processor list for change notifications.
On compliance, plainly.
We won’t claim certifications we don’t hold: Spodus carries neither SOC 2 nor ISO 27001. What we can show you is verifiable — every sub-processor named above, a data processing agreement you can read before you sign, a privacy notice, and a vulnerability disclosure policy with a safe harbour for good-faith research.
You can export or delete your data at any time. If your procurement needs a badge today, talk to us.
How is my data encrypted?
In transit, everything uses TLS (HTTPS). Stored third-party credentials — the passwords and tokens for a mailbox or calendar you connect — are encrypted with AES-256-GCM before they touch the database. Backup dumps are encrypted before they leave the server, with a public key whose private half is held offline and on no server. The database volume itself is not separately encrypted today; it is access-controlled and held on dedicated hardware.
Who at Spodus can see my data?
Access is limited to the small number of staff who need it to run and support the service, gated behind authentication and logged. We never sell your data or use it to train third-party models.
How often do you back up, and can I get my data out?
Nightly. Each backup is encrypted before it leaves the server, kept 14 days, copied the same night to a second, independent host that keeps 30 days, and a further encrypted copy is kept off-site. Because backups are nightly rather than continuous, a restore returns you to the last nightly run — up to 24 hours of changes could be lost. You can export your records yourself at any time.
Do you hold SOC 2 or ISO certifications?
No. Spodus is a young company and holds neither SOC 2 nor ISO 27001, and we won't display badges we haven't earned. Our infrastructure providers are independently certified and we list each one by name with its certifications above, but that is their audit, not ours.
Where is my data stored?
In Germany, at Hetzner's Nuremberg data centre, inside the EU, with Cloudflare in front for DNS, TLS and DDoS protection. We do not currently offer hosting in any other region.
How do I report a vulnerability?
Email security@spodus.com. Our vulnerability disclosure policy at /security/disclosure sets out what's in scope, what we commit to (acknowledgement within 3 business days), and a safe harbour for good-faith research. We don't run a paid bounty.
