Everything your security team needs to evaluate Specky. SOC 2 alignment, GDPR/CCPA compliance, encryption details, data residency, sub-processors, DPA, and incident response.
We continuously align with leading security frameworks. Below is the current status of each certification or compliance regime.
Security controls mapped to SOC 2 Trust Service Criteria. Independent audit report available under NDA for enterprise evaluations. Full Type II certification in progress.
Full compliance with the EU General Data Protection Regulation. Data Processing Agreement (Art. 28) available. All data subject rights (Art. 15–20) are self-serviceable from workspace settings.
Aligned with UK GDPR (retained from the EU GDPR post-Brexit). International Data Transfer Agreements (IDTA) available for UK-to-non-UK transfers.
Compliant with the California Consumer Privacy Act and California Privacy Rights Act. Opt-out mechanisms, data deletion, and right-to-know requests supported.
ISO 27001 Information Security Management System certification is on the roadmap for 2026. Controls are being implemented to meet the standard.
BAA (Business Associate Agreement) available for healthcare customers processing protected health information (PHI). Contact us to discuss HIPAA-compliant deployment options.
Your product data is sensitive. Here's a precise account of where it goes, who can see it, and how it's protected.
Specky is built on managed, enterprise-grade infrastructure with defence-in-depth encryption at every layer.
Specky supports multiple auth methods and fine-grained access control to match your security posture.
We maintain a complete list of sub-processors with access to customer data. We notify customers 30 days before adding a new sub-processor. Last updated: April 2026.
| Processor | Purpose |
|---|---|
| Supabase | Database, Auth, Storage |
| Vercel | Compute & Edge Network |
| Google Generative AI | AI inference (Gemini) |
| Stripe | Payment processing |
| PostHog | Product analytics (opt-in) |
| Resend | Transactional email |
| Google Analytics | Marketing analytics (opt-in) |
Want the full sub-processor list with DPA annexes? Email security@specky.space
We take security incidents seriously. Here's what happens when something goes wrong.
We notify affected customers within 72 hours of confirming a data breach, meeting GDPR Art. 33/34 and CCPA requirements. Notification includes nature of the incident, data affected, and remediation steps.
Critical security incidents: 1-hour initial response, 4-hour containment target. High-severity issues: 4-hour response, 24-hour resolution target. All security issues: 5 business days.
We operate a responsible disclosure programme. If you find a vulnerability, email security@specky.space with details. We'll respond within 2 business days and credit you in our Hall of Fame if you wish.
Annual third-party penetration tests are conducted by an independent security firm. Summary reports are available to enterprise customers under NDA. Our last test was completed January 2026.
Our security team responds to all enquiries within one business day. We can provide SOC 2 reports, DPAs, completed security questionnaires, pen test summaries, and custom contractual arrangements.
Last reviewed: April 2026 · Next review scheduled: October 2026