Tenant isolation
Every borrower, loan, and document is scoped to your organization. Records from one tenant are never readable from another.
Trust and reliability
SpreadSpace handles lender and borrower financials. Here is how that data is protected, and how reliably the service runs.
Encryption in transit and at rest
TLS 1.2 or higher on every connection. Databases, document stores, and logs are encrypted at rest with AES-256. Uploaded documents and the production database use dedicated KMS keys that rotate automatically.
Access control
Six-role access control, org-wide MFA enforcement, and PII access locks. Included on every plan.
Explore the Compliance BundleAudit trail
PII access, organization activity, and API events are each logged, with up to 7-year retention.
See the log surfacesSocial Security numbers and EINs
Extracted data keeps only the last four digits of a Social Security number or EIN. The full number is masked before the data is stored, and again before it leaves the API. On a borrower profile, those four digits are encrypted a second time.
Data location and deletion
Document data is processed and stored in the United States. The original file you upload is deleted 7 days after upload. The page images used for document review, and the figures extracted from them, stay until you delete the borrower, loan, or document, or close your account.
Backups and recovery
The production database runs across two availability zones and keeps 30 days of point-in-time backups. We rehearse a restore from backup every quarter.
Network protection
The API sits behind a web application firewall and per-client rate limits. The database accepts no connections from the public internet.
Secure development
Every code change is scanned for leaked secrets. The codebase is analyzed for vulnerabilities every day, and its dependencies are checked every week.
API keys and webhooks
API keys are stored only as salted hashes, carry explicit scopes, and can be rotated without downtime. Every webhook delivery is signed.
Read the API security notesReview our Sub-Processors and Privacy Policy, or talk to us for security documentation.