Trust & Security
This page is maintained by Spend360 to answer common security and privacy questions about our platform. It describes the controls that are live today and the commitments that are in progress.
Spend360 runs on managed cloud infrastructure. Platform capabilities described here are features we have enabled, not independent certifications issued to Spend360.
Live security controls
Encryption in transit and at rest
All traffic to and from Spend360 is encrypted with TLS. Data at rest is encrypted using the managed infrastructure's default encryption (AES-256).
Encrypted API keys at rest
Provider API keys are encrypted with Supabase Vault before being stored. They are never held in plain-text columns, and decrypted keys are shown only to authorized users in the application UI.
Row-level security (RLS)
Multi-tenant isolation is enforced at the database level. Every query is scoped to the requesting user's organization through RLS policies, so cross-organization data access is not possible through normal application paths.
BU Admin access isolation
BU Admins are assigned to a single business unit. Database-level RLS clamps restrict them to their own BU's provider keys, members, and spend data. They cannot see or modify another business unit's data.
Tamper-proof audit trail
Audit logs are append-only. Writes are restricted to service-role contexts; users and ordinary application code cannot modify or delete existing audit records.
SSO / SAML via WorkOS
Enterprise single sign-on is available through WorkOS SAML connections. Organization owners can configure SAML connections and require members to sign in through the corporate identity provider.
Clickjacking protection
Every HTTP response includes X-Frame-Options: DENY and a Content-Security-Policy with frame-ancestors 'none', preventing the application from being rendered inside an external frame.
Compliance roadmap
SOC 2 Type I
In progress. We are working toward SOC 2 Type I with Vanta, targeting readiness within the next 2–3 months. This is not a completed certification or audit.
GDPR
Coming soon. We are planning the controls and documentation required for GDPR support; this is not yet complete.
Privacy
Minimal data collection
We collect only the data needed to provide the service — account details, team membership, usage metrics, and audit events.
No data selling or sharing
We do not sell or share user data with third parties for advertising or any other purpose.
Limited retention
Data is retained only as long as needed to provide the service. You can request deletion by contacting us at contact@spend360.ai.
Shared responsibility
Platform security features such as encryption, RLS, and Vault are provided by the underlying managed infrastructure. Spend360 configures and uses these features, but customers remain responsible for their own account security — for example, managing membership, assigning roles correctly, configuring SSO connections, and following their own internal policies.