Security is built into sparx’s architecture, not bolted on. Here is how we protect your data and your customers’.
sparx is multi-tenant, and isolation is enforced at the database layer with PostgreSQL row-level security, not just in application code. Every tenant-scoped table carries a tenant id and a policy that makes cross-tenant reads impossible even if application logic has a bug. It is the backstop the rest of the platform is built on.
Data is encrypted in transit with TLS and at rest by default across our database, object storage, and backups. Secrets are managed through a dedicated secret store, never checked into source.
Every account can turn on a second step at sign-in, and we support two kinds. Passkeys are the stronger one: the secret never leaves your device, so there is nothing for a fake sign-in page to steal. Authenticator apps work anywhere, on any phone. Backup codes are stored encrypted rather than in plain text, so a database copy does not hand anyone ten working ways into your account.
We have a written policy for what happens when an authority demands data, and we follow it before anything is disclosed: check that the request is a valid legal instrument, challenge it if it is unlawful or overbroad, disclose only the minimum it compels, tell the affected customer unless a court order forbids it, and log every request, including the ones we refuse. Section 10 of the Privacy Policy and section 9 of the DPA set out the commitment in full.
We offer a GDPR/CCPA-aligned Data Processing Addendum, we publish the full list of companies that handle data on our behalf, and our Privacy Policy describes how we handle personal data as both a controller and a processor.
We build to the controls a SOC 2 examination covers, but we have not completed one and hold no SOC 2 report today. We would rather tell you that than imply a certificate we cannot produce. When an examination is underway we will say so here, with the auditor and the period named, and the report itself will be available under NDA.
If you believe you have found a security issue, please email [email protected]. We investigate all reports and will work with you on coordinated disclosure. A vendor security questionnaire and incident-response summary are available to customers on request.