Platform overview
Trust and reliability
How SpreadSpace protects lender and borrower financials, manages access, and supports service reliability.
Tenant isolation
Every borrower, loan, and document is scoped to your organization. Records from one tenant are never readable from another.
Encryption in transit and at rest
TLS 1.2 or higher on every connection. Databases, document stores, and logs are encrypted at rest with AES-256. Uploaded documents and the production database use dedicated KMS keys that rotate automatically.
Access control
Six-role access control, org-wide MFA enforcement, and PII access locks. Included on every plan.
Audit trail
PII access, organization activity, and API events are each logged, with up to 7-year retention.
Social Security numbers and EINs
Extracted data keeps only the last four digits of a Social Security number or EIN. The full number is masked before the data is stored, and again before it leaves the API. On a borrower profile, those four digits are encrypted a second time.
Data location and deletion
Document data is stored and processed by our systems in the United States; the security edge in front of the service terminates connections at the location nearest you and does not store document data. The original file you upload is deleted 7 days after upload. A Plaid or Finicity transactions file uploaded as JSON is deleted as soon as its statements are extracted and recorded. The page images used for document review, and the figures extracted from them, stay until you delete the borrower, loan, or document, or close your account.
Backups and recovery
The production database runs across two availability zones and keeps 30 days of point-in-time backups. We rehearse a restore from backup every quarter.
Network protection
The API sits behind a web application firewall and per-client rate limits. The database accepts no connections from the public internet.
Secure development
Every code change is scanned for leaked secrets. The codebase is analyzed for vulnerabilities every day, and its dependencies are checked every week.
API keys and webhooks
API keys are stored only as salted hashes, carry explicit scopes, and can be rotated without downtime. Every webhook delivery is signed.
Security documentation
Review our Sub-Processors and Privacy Policy, or talk to us for security documentation.