Trust center
Trust and service levels
- Uptime target 99.5% monthly per customer Environment
- P1 response First response within 4 business hours
- Support window Business days 09:00–17:00 CET · hello@spot-suite.com
- Incidents Email notification to affected customers with a post-incident summary
- Maintenance Announced in advance · most updates deploy without downtime
- Contractual SLA Available for enterprise agreements on request
Subprocessors
- Cloudflare Files (R2) in Western Europe, not pinned to an EU jurisdiction · compute and logs run on Cloudflare’s global network
- Supabase EU (Paris, on AWS) · product database, one schema per Environment in a shared Postgres project
- Microsoft 365 Email through Microsoft Graph · region not pinned by us
- Google Fonts Typefaces in the app and emails · receives IP address · region not pinned by us
- Microsoft Azure Only for workspaces bought through Azure Marketplace · in the Azure region the buyer picks at purchase: North Europe, West Europe or a US region
- Changes Customers are notified in advance before any subprocessor change
- Full list Every Spot Suite subprocessor, what it receives, and where
Posture, disclosure, and paperwork
-
EU databases by default
Customer databases are stored in the EU by default (Supabase, Paris) and xEvolve files in Cloudflare R2 in Western Europe, not locked to an EU jurisdiction, under Spot Cloud B.V., registered in the Netherlands. A workspace bought through Azure Marketplace is stored in the Azure region the buyer picks, which can be outside the EU. Transfers outside the EU/EEA happen only on the customer’s written instruction.
-
Identity and provisioning
Spot Suite single sign-on with a Microsoft account or an e-mail code. SAML and SCIM provisioning are on the enterprise roadmap, prioritized with design partners.
-
Vulnerability disclosure
Report security issues to hello@spot-suite.com. Reports are acknowledged within two business days and disclosure is coordinated with the reporter. A machine-readable policy lives at /.well-known/security.txt.
-
Security questionnaires
SIG- and CAIQ-style vendor questionnaire answers and the DPA are available on request, with a typical turnaround of two business days.
-
Backups and continuity
The Postgres database (each Environment’s schema, configuration, and audit records) lives in the shared EU Supabase project. Supabase backs it up once a day and keeps each backup for seven days, with no point-in-time restore, and we run our own hourly dump of every schema into a separate Cloudflare R2 bucket in Western Europe. Transferred files are stored in a different shared R2 bucket and are not covered by either backup today: they rely only on R2’s own storage durability, with no point-in-time backup or version history. There is no failover to a second region, no restore drill has been run, and restoring is a manual, unverified process. No recovery-point or recovery-time target is published today.
Running a vendor security review?
Get the DPA or questionnaire answers — typical turnaround two business days.