APIGetting Started

Security and compliance

How the API protects the documents and figures it handles, and where the supporting documents live.

The API handles lender and borrower financials. This page states what the service does with that data and what you can rely on when you integrate. The policies behind it (privacy, terms, sub-processors) are linked at the end; for security documentation beyond this page, write to support@spreadspace.ai.

Isolation

Every borrower, loan, document and extracted figure belongs to exactly one organization. An API key reads and writes only its own organization’s records. A request that names a record in another organization answers 404, the same as a record that does not exist, so ids never reveal what exists elsewhere.

Encryption

  • In transit: TLS on every connection to api.spreadspace.app, including webhook deliveries to your endpoint.
  • At rest: uploaded files, extraction outputs and the compliance archive are stored in object storage encrypted under managed keys. The database that holds borrowers, loans and extracted figures uses encrypted storage, under a dedicated key in production.

API keys

  • A key is shown once, at creation, and stored only as a salted hash. It cannot be recovered later; revoke it and create a new one.
  • Keys carry an explicit scope set (see Authentication) and a mode, ss_live_ or ss_test_. A test key can never read live data.
  • Keys can be revoked at any time from the dashboard; a revoked key answers 401 on its next request. A rotation keeps the old key valid for a grace period chosen at rotation time (24 hours by default), so a deploy can move to the new key without a gap.

Webhooks

  • Endpoint URLs must use https://; a plain http:// endpoint is rejected when it is registered.
  • Every delivery is signed. Verify the SpreadSpace-Signature header with your endpoint’s secret before trusting a payload; the secret can be rotated with an overlap window so a rotation never drops a delivery. Details on Webhooks.
  • A delivery that your endpoint answers with 429, a 5xx, or no response is retried with exponential backoff (1 s, 2 s, 4 s, and so on), up to 12 attempts within 24 hours of the event. A 4xx other than 429 ends the attempts at once, because your endpoint rejected the delivery on purpose.
  • Production deliveries originate from one address, 3.218.66.242, for endpoints that allowlist by source IP. A change to that address is announced on the Changelog at least 30 days before it takes effect.

Retention and deletion

  • An uploaded file is deleted from storage 7 days after upload. The figures extracted from it stay until you delete them.
  • Deletion is explicit and has no undo: Delete an extracted document removes one document and its figures, Delete job removes an upload and everything extracted from it, and the loan and borrower deletes remove the records beneath them. Each destruction is recorded in the access log.
  • Access to personal data, organization activity and API events are each logged. The compliance archive that holds those records is write-once, with a seven-year retention lock.
  • When a customer agreement ends, the data stays exportable through the API for 30 days and is then deleted or de-identified, subject to legal retention requirements and backup cycles (Master Service Agreement, section 11).

Workspace access

Organizations that also use the workspace have six roles, organization-wide multi-factor enforcement, and locks on access to personal data. These govern people, not API keys; a key’s authority is its scope set alone.

Service status

GET https://api.spreadspace.app/health answers 200 with the body Healthy when the API is up. https://spreadspace.app/status shows the result and time of the most recent probe.

Compliance documents

For the current control summary and audit status, write to support@spreadspace.ai.