Security and data handling

If you work in a regulated institution, your procurement process will ask questions before your IT team gets a say. This page answers the ones we can answer in public. For anything further, including a completed vendor assessment questionnaire, ask and we will send it.

Your data belongs to you

You retain all right, title and interest in everything you put into Spectra Core: audits, findings, evidence, screenshots and custom standards. We claim no ownership over it. We access it only to run and support the service, to deal with a technical or security issue, or where the law requires it. The binding version of this is section 10 of the SaaS agreement.

Leaving, and taking your data with you

On termination, or at any time on written request, we make your data available for export in a reasonable format for 30 days. There is no exit fee and no hostage period. Cancellation itself is month to month, effective at the end of the paid month.

Anonymised data

We may use anonymised and aggregated data derived from customer data for analytics, benchmarking and product development, in a form that no longer identifies you or any individual. If that is a problem for your institution, raise it before you sign and we will talk about it rather than pretend the clause is not there.

Sub-processors

These are the third parties involved in delivering the service.

Payments

Billing runs through Stripe. Card details are handled by Stripe and are never stored by Spectra Core.