01TRUST AND SECURITY
Security posture — facts only.
This page describes where your data is stored, who processes it, and what security controls are in place. No marketing, no certifications we have not earned.
Last updated: 2026-09-11
02
Compliance posture
Spekir is built toward SOC 2 Type 1 readiness. Evidence collection is scaffolded and controls are being implemented. We are not currently certified.
GDPR: We operate as a data processor under GDPR. Processor obligations are met. A Data Processing Agreement (DPA) is available on request.
| Standard | Status | Target date |
|---|---|---|
| SOC 2 Type I | PlannedControls documented. Readiness work in progress. | Q3 2026Planned |
| SOC 2 Type II | On roadmap12-month observation period starts after Type I. | Q1 2027Planned |
| ISO 27001 | On roadmapISMS gap analysis planned after SOC 2 Type I milestone. | Q3 2027Planned |
03
Hosting & data residency
| Application hosting | Vercel — Frankfurt, EU (eu-central-1 / fra1) |
|---|---|
| Database | Neon PostgreSQL — Frankfurt, EU (eu-central-1) |
| Data at rest | All customer data stored in EU regions. No customer data leaves the EU at rest. |
| Build secrets | Stored in Vercel environment variables — never in source code |
| CDN edge nodes | Vercel Edge Network — requests served from nearest PoP, data pinned to Frankfurt |
04
Authentication
| Provider | NextAuth v5 — self-hosted, no third-party identity broker |
|---|---|
| Methods | Email + password (bcrypt hashed), Google OAuth |
| Sessions | Stored in Neon PostgreSQL (same EU region). JWT-signed server sessions. |
| 2FA / MFA | TOTP-based 2FA available in Settings → Security |
| SSO / SAML | Q4 2026Planned |
| SCIM provisioning | Planned Q4 2026Planned |
05
Encryption
| In transit | TLS 1.3 enforced on all endpoints. HSTS enabled with 1-year max-age. |
|---|---|
| At rest | AES-256 managed by Neon (transparent encryption at storage layer). BYOK targeted Q3 2026.BYOK planned |
| Secrets & API keys | Vercel environment variables — injected at build time, never stored in git or logs |
| User API keys | Hashed with bcrypt before storage. Raw key shown once at creation only. |
06
Backups & data retention
| Automated backups | Neon point-in-time recovery — 7 days, on every branch and every workspace |
|---|---|
| Self-serve export | Workspace data export (JSON + CSV) available from Settings → Trust Dashboard |
| Deletion on request | Workspace data deleted within 30 days of verified deletion request |
| Audit log retention | 12 months, append-only. No deletion from application code. |
| Backup drill | Restore drill run quarterly against Neon child branch (not production). Evidence committed internally. |
07
Subprocessors
The following third parties process data on our behalf. We review subprocessors regularly and notify customers of material changes.
| Processor | Purpose | Region | DPA |
|---|---|---|---|
| Vercel | Application hosting and CDN | EU (Frankfurt eu-central-1) | DPA ↗ |
| Neon | PostgreSQL database hosting | EU (Frankfurt eu-central-1) | DPA ↗ |
| Anthropic | AI model inference (Claude)Zero data retention configured. Opt-out of model training enforced via API agreement. | US (no EU region available) | DPA ↗ |
| Resend | Transactional email delivery | US / EU | DPA ↗ |
| Stripe | Payment processing | EU (Ireland) | DPA ↗ |
| Langfuse | AI observability and tracing | EU (Frankfurt) — self-hosted | Internal |
| Inngest | Background job orchestration | US (no EU region) | DPA ↗ |
Need a DPA? Email hello@spekir.com — we will send the agreement within two working days.
08
Platform status
| Status page | Targeted Q3 2026 at status.spekir.comPlanned |
|---|---|
| Uptime target | 99.5% monthly. Measured, not contractually guaranteed during Early Access. |
| Incident notification | Workspace admins notified within 24h of confirmed incident. GDPR Art. 33 notification within 72h. |
| Vulnerability reports | Email security@spekir.com — the full responsible-disclosure policy is on the Security page |
09
Topic deep-dives
Security
TLS 1.3, AES-256 at rest, NextAuth v5, audit logs, and rate limits.
SecurityCompliance
GDPR posture, EU AI Act roadmap, and SOC 2 progress.
ComplianceData handling
How your data flows — from ingest through deletion.
Data handlingIncidents
Full history. No reported security incidents to date.
IncidentsSubprocessors
Vercel, Neon, Anthropic, and Resend — with regions and DPA links.
SubprocessorsData residency
Where your data lives — Frankfurt-first, tri-state residency policy, AI compute location, and sub-processor details.
Data residencyAI data handling
How Atlas uses AI with your portfolio — what flows to AI providers, what doesn't, retention facts, and customer controls.
AI data handling10
Contact
Security questions
For questions about our security posture, DPA requests, or data residency.
hello@spekir.comResponsible disclosure
Found a vulnerability? See our disclosure policy and safe harbour clause.
Read the security policy