Security

Data Storage & Encryption

• Account and billing data is stored in a managed PostgreSQL database, encrypted at rest with AES-256 and in transit with TLS 1.2 or higher
• Tenant isolation is enforced at the database layer through row-level security rather than in application code, so each account can only reach its own data
• Published web snapshots are held in private cloud object storage and served read-only through the application
• User credentials are managed by our authentication provider using bcrypt hashing

Local-First & Encrypted by Default

Your canvases live on your computer, not on our servers. Spectacle Cloud adds opt-in services designed to see as little of your data as possible:

• Local-first storage: Your canvases and notes never leave your device unless you explicitly export or share them. Spectacle Desktop encrypts your local database at rest by default with SQLCipher, and you can switch to a standard unencrypted SQLite file in Settings.
• Browser-authorized device sessions: The desktop app signs in through your browser at /desktop/authorize using the OAuth authorization-code flow with PKCE, and receives a device session scoped to one workspace. No long-lived shared secret is stored.
• End-to-end encrypted Live Jams: Collaborative strokes stream directly between participants. The room encryption key is placed in the link fragment (#key=...) and never reaches our servers, so we cannot read a live session.
• Published web snapshots: When you publish a read-only snapshot, it is stored encrypted at rest, with optional password protection. You can delete it at any time.
• Stateless managed AI routing: Spectacle Cloud AI forwards your queries to managed models without persisting your prompts, completions, or canvas contents.

Authentication & Access Control

• Browser-authorized device sessions for desktop sign-in, using the OAuth authorization-code flow with PKCE
• Row-Level Security (RLS) enforces tenant isolation at database level
• JWT-based session management

Data Retention

• Account and billing data is retained while your account remains active
• Published snapshots are retained until you delete them or close your account
• Managed AI routing keeps only aggregate usage counts and timestamps to meter subscription quotas; prompts and completions are never stored
• Analytics are retained for up to 2 years, and payment records for 7 years to meet accounting obligations

Data Removal

• Canvas data is local-first on your machine. Published snapshots can be deleted instantly from the dashboard or the desktop app.
• Live Jam sessions are end-to-end encrypted and ephemeral; all connection and canvas memory is expunged immediately when the session closes.
• Deleting an account removes all associated device sessions, snapshot records, and usage metrics.
• Deletion requests can also be sent to privacy@spectacle.so and are processed within 30 days; copies may persist in encrypted backups for up to 90 days.
• Spectacle Cloud does not archive customer content for its own purposes.

Third-Party Security

• All third-party APIs use OAuth 2.0 or API keys with minimal scope
• OAuth tokens encrypted at rest
• Regular security audits of integration permissions

AI Transparency

• Spectacle Cloud AI routes requests to managed models and forwards them statelessly: your prompts and completions are never logged, stored on disk, or cached.
• Neither Spectacle nor our underlying model providers use your content or queries to train models.
• You can review your usage and subscription quotas at any time in your dashboard.

Incident Response

• Automated monitoring, rate limiting, and DDoS protection via Cloud Armor
• Documented incident response and key rotation procedures
• Security vulnerabilities can be reported via security@spectacle.so — see Vulnerability Disclosure below

Vulnerability Disclosure

We welcome reports from security researchers and treat them as a core part of how we keep Spectacle safe. Send reports to security@spectacle.so. Include the affected component, the steps needed to reproduce the issue, and what an attacker could achieve with it. If a report contains sensitive detail, say so and we will arrange an encrypted channel before you send it.

This is a coordinated disclosure program, not a paid bug bounty. We do not offer monetary rewards, but we will credit reporters who ask to be named once an issue is resolved.

What is in scope

Every product surface we operate is in scope:

• The Spectacle Cloud web application and API at spectacle.so
• The Spectacle Cloud AI OpenAI-compatible proxy (/api/v1/chat/completions)
• The Live Jam signaling relay (/api/v1/jam/signaling)
• Canvas Snapshot upload and web viewing endpoints (/s/:id)
• Device session authentication and billing systems

What is out of scope

• The infrastructure of our subprocessors, listed below. Report those to the provider directly
• Vulnerabilities in a customer's own connected systems, such as their Google Workspace or SharePoint tenant
• Denial of service, volumetric or load testing, and physical attacks
• Social engineering of our team, our customers, or our providers
• Scanner output with no demonstrated impact, and missing hardening headers or best practices with no working exploit path

Safe harbor

We will not pursue legal action against you, or ask others to, for security research conducted in good faith under this policy. To stay within it:

• Test only against accounts and workspaces you own or have permission to use. Never access, modify, or retain another customer's data
• Stop as soon as you have confirmed a vulnerability. If you reach customer data by accident, stop, do not save it, and tell us in your report
• Do not degrade our service or the service of a Slack or Teams workspace you are testing against
• Give us time to fix the issue before disclosing it publicly. Ninety days is our default, and we are happy to agree on something different when a fix needs longer

If you are unsure whether a specific test is permitted, ask us first at security@spectacle.so.

How we respond

• We acknowledge every report within 5 business days
• We complete triage and tell you whether we have validated the issue, along with its severity, within 10 business days
• We keep you updated as we work, and confirm when a fix has shipped
• Our remediation targets from the point of validation are 7 days for critical, 30 days for high, and 90 days for medium severity issues. Lower severity issues are addressed on our regular roadmap
• Where an issue affected customer data, we notify affected customers in line with our incident response procedures and applicable law

Subprocessors

We use the following subprocessors to deliver our service. Each has been vetted for security and compliance.

For questions about our security practices or to report a vulnerability, please contact security@spectacle.so.