Security
Isolation, encryption, and audit by default
- Identity Spot Suite single sign-on
- Sign-in Microsoft account or e-mail code
- Isolation Shared Worker · schema in Supabase Postgres (Paris) · shared R2 file storage
- Encryption AES-256 at rest · TLS 1.2 or newer in transit
- Residency EU database (Paris) · files in Western Europe
- Subprocessors Full Spot Suite list · what each receives and where
- Audit Per-event log · export on request
- PGP OpenPGP encrypt/decrypt per route · keys encrypted at rest
How the controls work
-
Spot Suite single sign-on
Operators sign in through Spot Suite single sign-on, with a Microsoft account or an e-mail code.
-
Tenant-scoped access
Each Environment keeps its own schema in the shared EU Postgres database (Supabase, Paris), with files in shared Cloudflare R2 storage. Transfer files and audit metadata are scoped to your tenant.
-
AES-256 and TLS
Files at rest in R2 use AES-256. Browser and API traffic uses TLS 1.2 or newer (TLS 1.3 when the client supports it); HTTPS and FTPS adapters use TLS, SFTP uses SSH.
-
EU data residency
Customer databases are stored in the EU (Supabase, Paris) and files in Cloudflare R2 in Western Europe, by default on every plan, under Spot Cloud B.V., registered in the Netherlands. Direct signup is EU-only on every plan: files are stored in shared Cloudflare R2 in Western Europe (not locked to an EU jurisdiction) and the database is the shared EU Postgres (Supabase, Paris). Workspaces bought through Azure Marketplace are stored in the Azure region the buyer picks: North Europe, West Europe or a US region.
-
Per-event audit logging
Every login, upload, download, and permission change records user ID, client IP, and UTC timestamp. Audit export is available on request for internal reviews or external assessors.
-
Tenant-scoped partner credentials
Partner SFTP accounts and API keys are scoped to your Environment with expiry review. Formal SOC 2 certifications are not claimed.
-
OpenPGP key management
Generate or import PGP key pairs per Environment. Share public keys with partners while private keys stay encrypted at rest and are only loaded at transfer time.
Walk through the security model
Book a 30-minute demo covering tenant isolation, encryption, and the activity log.