Security

Isolation, encryption, and audit by default

Spot Suite OIDC and TOTP MFA

Operators authenticate through Spot Suite OIDC with Microsoft Entra ID, Okta, or any OIDC provider. TOTP enrollment is enforced on every account — no operator session without a second factor.
Dedicated per-customer isolation

Each Environment gets its own Cloudflare Worker runtime, D1 database, and R2 storage bucket. Transfer files and audit metadata are not co-mingled with another customer.
AES-256 and TLS 1.3

Files at rest in R2 use AES-256. All protocol adapters connect over TLS 1.3 (or explicit TLS for FTPS). Checksums are recorded on every handoff.
EU data residency

All customer data is processed and stored in the EU by default, on every plan, under Spot Cloud B.V., registered in the Netherlands. Business and MSP plans add region pinning and residency scoping controls.
Per-event audit logging

Every login, upload, download, and permission change records user ID, client IP, and UTC timestamp. Export the audit packet for internal reviews or external assessors.
Tenant-scoped partner credentials

Partner SFTP accounts and API keys are scoped to your Environment with expiry review. Control mapping to ISO 27001:2022 (A.8.10, A.8.12), DORA, GDPR, and CIS is shared under NDA — formal SOC 2 or ISO certifications are not claimed.
OpenPGP key management

Generate or import PGP key pairs per Environment. Share public keys with partners while private keys stay encrypted at rest and are only loaded at transfer time.

Book a 30-minute demo covering tenant isolation, encryption, and audit exports.