Skip to navigation
APIGetting Started

Security and compliance

How the API protects the documents and figures it handles, and where the supporting documents live.

The API handles lender and borrower financials. This page states what the service does with that data and what you can rely on when you integrate. The policies behind it (privacy, terms, sub-processors) are linked at the end.

Isolation

Every borrower, loan, document and extracted figure belongs to exactly one organization. An API key reads and writes only its own organization’s records. A request that names a record in another organization answers 404, the same as a record that does not exist, so ids never reveal what exists elsewhere.

Encryption

  • In transit: TLS on every connection, including webhook deliveries to your endpoint. api.spreadspace.app accepts TLS 1.2 and higher only.
  • At rest: uploaded files, extraction outputs and the compliance archive are stored in object storage encrypted with AES-256 under managed keys. The database that holds borrowers, loans and extracted figures uses AES-256 encrypted storage, under a dedicated key in production.

API keys

  • A key is shown once, at creation, and stored only as a salted hash. It cannot be recovered later; revoke it and create a new one.
  • Keys carry an explicit scope set (see Authentication) and a mode, ss_live_ or ss_test_. A test key can never read live data.
  • Keys can be revoked at any time from the dashboard; a revoked key answers 401 on its next request. A rotation keeps the old key valid for a grace period chosen at rotation time (24 hours by default), so a deploy can move to the new key without a gap.

Webhooks

  • Endpoint URLs must use https://; a plain http:// endpoint is rejected when it is registered.
  • Every delivery is signed. Verify the SpreadSpace-Signature header with your endpoint’s secret before trusting a payload; the secret can be rotated with an overlap window so a rotation never drops a delivery. Details on Webhooks.
  • A delivery that your endpoint answers with 429, a 5xx, or no response is retried, up to 12 attempts in all, on the schedule given on the Webhooks page. A 4xx other than 429 ends the attempts at once, because your endpoint rejected the delivery on purpose.
  • Production deliveries originate from one address, 3.218.66.242, for endpoints that allowlist by source IP. A change to that address is announced on the Changelog at least 30 days before it takes effect.

Retention and deletion

  • The original file you upload is deleted from storage 7 days after upload. A Plaid or Finicity JSON response SpreadSpace reads (transactions, reports, liabilities, accounts, payroll income or pay statements) is deleted sooner, as soon as the documents read from it are extracted and recorded, so the raw response is never held past the job that read it. The page images used for document review, and the figures extracted from the file, stay until you delete the document, the job, or the loan or borrower above them, or close the account.
  • Deletion is explicit and has no undo: Delete an extracted document removes one document and its figures, Delete job removes an upload and everything extracted from it, and the loan and borrower deletes remove the records beneath them. Each destruction is recorded in the access log.
  • Access to personal data, organization activity and API events are each logged. The compliance archive that holds those records is write-once, with a seven-year retention lock.
  • When a customer agreement ends, the data stays exportable through the API for 30 days and is then deleted or de-identified, subject to legal retention requirements and backup cycles (Master Service Agreement, section 11).

Workspace access

Organizations that also use the workspace have six roles, organization-wide multi-factor enforcement, and locks on access to personal data. These govern people, not API keys; a key’s authority is its scope set alone.

Service status

GET https://api.spreadspace.app/health answers 200 with the body Healthy when the API is up. https://spreadspace.app/status shows the result and time of the most recent probe.

Compliance documents

For security documentation beyond this page, write to support@spreadspace.app.