> This page is for API.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.spreadspace.app/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.spreadspace.app/_mcp/server.

# Security and compliance

The API handles lender and borrower financials. This page states what the
service does with that data and what you can rely on when you integrate. The
policies behind it (privacy, terms, sub-processors) are linked at the end.

## Isolation

Every borrower, loan, document and extracted figure belongs to exactly one
organization. An API key reads and writes only its own organization's
records. A request that names a record in another organization answers
`404`, the same as a record that does not exist, so ids never reveal what
exists elsewhere.

## Encryption

* In transit: TLS on every connection, including webhook deliveries to your
  endpoint. `api.spreadspace.app` accepts TLS 1.2 and higher only.
* At rest: uploaded files, extraction outputs and the compliance archive are
  stored in object storage encrypted with AES-256 under managed keys. The
  database that holds borrowers, loans and extracted figures uses AES-256
  encrypted storage, under a dedicated key in production.

## API keys

* A key is shown once, at creation, and stored only as a salted hash. It
  cannot be recovered later; revoke it and create a new one.
* Keys carry an explicit scope set (see
  [Authentication](/api/authentication)) and a mode, `ss_live_` or
  `ss_test_`. A test key can never read live data.
* Keys can be revoked at any time from the dashboard; a revoked key answers
  `401` on its next request. A rotation keeps the old key valid for a grace
  period chosen at rotation time (24 hours by default), so a deploy can move
  to the new key without a gap.

## Webhooks

* Endpoint URLs must use `https://`; a plain `http://` endpoint is rejected
  when it is registered.
* Every delivery is signed. Verify the `SpreadSpace-Signature` header with
  your endpoint's secret before trusting a payload; the secret can be rotated
  with an overlap window so a rotation never drops a delivery. Details on
  [Webhooks](/api/webhooks).
* A delivery that your endpoint answers with `429`, a `5xx`, or no response
  is retried, up to 12 attempts in all, on the schedule given on the
  [Webhooks page](/api/webhooks#delivery). A `4xx` other than `429` ends the
  attempts at once, because your endpoint rejected the delivery on purpose.
* Production deliveries originate from one address, `3.218.66.242`, for
  endpoints that allowlist by source IP. A change to that address is
  announced on the [Changelog](/api/changelog) at least 30 days before it
  takes effect.

## Retention and deletion

* The original file you upload is deleted from storage 7 days after upload.
  A Plaid or Finicity JSON response SpreadSpace reads (transactions, reports,
  liabilities, accounts, payroll income or pay statements) is deleted sooner,
  as soon as the documents read from it are extracted and recorded, so the raw
  response is never held past the job that read it. The page images used for document
  review, and the figures extracted from the file, stay until you delete the
  document, the job, or the loan or borrower above them, or close the account.
* Deletion is explicit and has no undo:
  [Delete an extracted document](/api/api-reference/extractions/delete-extracted-document)
  removes one document and its figures,
  [Delete job](/api/api-reference/jobs/delete-job) removes an upload and
  everything extracted from it, and the loan and borrower deletes remove the
  records beneath them. Each destruction is recorded in the access log.
* Access to personal data, organization activity and API events are each
  logged. The compliance archive that holds those records is write-once, with
  a seven-year retention lock.
* When a customer agreement ends, the data stays exportable through the API
  for 30 days and is then deleted or de-identified, subject to legal retention
  requirements and backup cycles
  ([Master Service Agreement, section 11](https://spreadspace.app/legal/msa#m-term)).

## Workspace access

Organizations that also use the workspace have six roles, organization-wide
multi-factor enforcement, and locks on access to personal data. These govern
people, not API keys; a key's authority is its scope set alone.

## Service status

`GET https://api.spreadspace.app/health` answers `200` with the body
`Healthy` when the API is up. `https://spreadspace.app/status` shows the
result and time of the most recent probe.

## Compliance documents

* [Trust and reliability](https://spreadspace.app/trust): the control summary.
* [Master Service Agreement](https://spreadspace.app/legal/msa): the
  agreement that governs use of the API. The specification's
  `info.termsOfService` points here.
* [Privacy policy](https://spreadspace.app/legal/privacy)
* [Sub-processors](https://spreadspace.app/legal/subprocessors)
* [Terms](https://spreadspace.app/legal/terms)

For security documentation beyond this page, write to
[support@spreadspace.app](mailto:support@spreadspace.app).