Documentation
Security Overview
Comprehensive details on how Specteron protects customer data, enforces tenant isolation, and operates a secure production environment.
Architecture & Tenant Isolation
Specteron is a multi-tenant SaaS platform hosted on enterprise-grade cloud infrastructure. Customer data remains logically separated at the database and application layers through strict tenant scoping.
- Strict Logical Isolation: Every API request is validated against the authenticated workspace scope. Cross-tenant access is blocked by application logic and authorization checks.
- Vector Database Segregation: Knowledge data is embedded and stored in isolated namespaces so retrieval only runs against the customer context authorized for that token.
- OpenAI API Data Handling: AI content is processed through the OpenAI API under OpenAI data controls. Specteron does not claim a special zero-retention agreement unless separately confirmed.
Encryption & Secrets Management
The platform applies defense-in-depth controls and standard encryption protocols across network traffic, storage, and secret handling.
- Encryption in Transit: Specteron uses HTTPS and transport encryption supported by the production hosting and service providers. No fixed TLS version is promised here.
- Storage Protection: Hosting and database protections are applied through the production provider. Specific at-rest algorithms and backup controls remain subject to provider verification.
- Secret Handling: Application secrets are kept in server-side configuration and access is limited to the scope needed to operate the service.
Identity & Access Control
Access to customer data is governed by least-privilege principles across support, engineering, and infrastructure operations.
- Customer Access (RBAC): Workspace owners can assign scoped roles to limit access to inbox, billing, knowledge, and operational settings.
- Operator Access: Production access should be limited to people who need it for operation, support or security. Access procedures are being formalised as the project grows.
- Account Security: The product supports account security controls. No unverified claim is made about mandatory MFA across every external provider account.
Secure Development Lifecycle (SDLC)
Security is built into development and release workflows so defects are caught before they reach production.
- Development Checks: Code and dependency checks are used where available to identify risky changes and known issues.
- Release Discipline: Changes are tested in proportion to their risk before production deployment.
- Independent Testing: Specteron does not currently claim a recurring third-party penetration-testing programme or a current independent certification.