Back to SpecMind

Security

Last updated: April 19, 2026.

SpecMind ("we", "our", "us") builds inspection software. This page explains how we protect the data inspectors and their clients entrust to us. We take this seriously — inspection reports often contain sensitive details about a home, a transaction, and the people involved.

Data residency & hosting

SpecMind runs on managed infrastructure in U.S. data centers. The primary database is PostgreSQL, hosted by Supabase. Application services are hosted by Railway. Photos and PDF reports are stored in encrypted object storage. All cross-region traffic uses TLS 1.2+.

Encryption

  • In transit. All connections to SpecMind use HTTPS with TLS 1.2 or higher. We enforce HSTS on all public domains.
  • At rest. Database storage and object storage (for photos, report PDFs, signature images) are encrypted at rest using AES-256.
  • Backups. Daily encrypted backups of the database are retained with point-in-time recovery for the most recent 7 days.

Authentication & access

  • Inspector and team accounts use email + password authentication with bcrypt-hashed credentials. Magic-link sign-in is supported on iOS.
  • Session tokens are signed JWTs with short-lived access tokens and longer-lived refresh tokens. Tokens are revoked on logout.
  • Internal access to production systems is gated by SSO and two-factor authentication. Audit logs are kept for all admin actions.
  • Service-role database access is restricted to backend services only. No human operator queries production data directly except for verified incident response.

Tenant isolation

SpecMind is multi-tenant. Inspectors and their teams cannot see each other's data. Tenant isolation is enforced at the application layer through an ownership filter applied to every database query — inspection, report, contact, agreement, payment, and template. Team members see only the inspections their company owns.

Payments

Payments are processed by Stripe. SpecMind does not store credit card numbers or bank routing details. Stripe is a PCI-DSS Level 1 certified provider; their compliance reporting covers the payment path end-to-end.

AI features

AI-assisted features (template generation, defect comment writing) send inspector-authored text to OpenAI's API. We do not send client names, addresses, photos, or PII to AI providers unless the inspector explicitly includes that information in the text they ask the AI to process. AI provider request/response data is not used to train models per our provider agreement.

Vulnerability disclosure

If you believe you've found a security vulnerability in SpecMind, please email security@specmind.ai. We respond to all good-faith reports within 1 business day and aim to triage critical issues within 24 hours of confirmation.

Subprocessors

SpecMind uses a small set of vetted subprocessors to deliver the service. The current list:

  • Supabase (PostgreSQL hosting, object storage)
  • Railway (application hosting)
  • Stripe (payment processing)
  • OpenAI (optional AI features)
  • Resend (transactional email delivery)
  • Twilio (optional SMS notifications)

Material changes to this list are reflected on this page and notified to enterprise customers under DPA.

Compliance status

SpecMind is not currently SOC 2 certified. We follow SOC 2 Type I-aligned controls and intend to pursue formal certification as we scale. Customers with specific compliance requirements (HIPAA, SOC 2, ISO 27001) should email security@specmind.ai to discuss.

Questions

Questions about our security posture? Email security@specmind.ai.