Trust Center
Where your product data lives, and who touches it
The facts your IT, legal and compliance teams ask for before a pilot: hosting locations, every sub-processor with its transfer basis, what our Data Processing Agreement covers, and the controls behind the product. Reviewed on 2026-09-09.
Data residency
Customer data is stored in the European Union. AI processing happens in the United States under Standard Contractual Clauses, on a provider that does not use your content to train models.
- Database and files
- European Union (Supabase)
- Application functions
- European Union, Frankfurt region (Vercel)
- AI processing
- United States (Anthropic), under Standard Contractual Clauses, no training on your data
- In transit
- TLS 1.2 or higher on every connection
Sub-processor register
Every provider that processes customer data on our behalf, what reaches it, where it runs and on what legal basis data leaves the EU. Each is bound by a data processing agreement. We notify customers with a DPA in place before adding a sub-processor.
| Provider | Purpose | Data | Location | Transfer basis |
|---|---|---|---|---|
| Supabase | Database, authentication, private file storage | Account data, extracted product data, source documents, translations, glossaries | European Union | EU hosting |
| Anthropic (Claude API) | AI extraction, audit, translation, document alignment, support assistant | Document content during processing; support questions with an account summary. Not used to train models. | United States | Standard Contractual Clauses |
| Vercel | Web hosting, serverless functions (EU region), cookieless performance analytics | Request data in transit; page-view and performance metrics without persistent identifiers | European Union functions, global edge network | EU-U.S. Data Privacy Framework and Standard Contractual Clauses |
| Stripe | Payment processing | Billing details and payment method (card data never reaches SpecMake) | United States | EU-U.S. Data Privacy Framework and Standard Contractual Clauses |
| Resend | Transactional and lifecycle email delivery | Email address, email content (notifications, reports, support replies) | United States | Standard Contractual Clauses |
| Cloudflare (Turnstile) | Optional bot check on the contact form | Browser signals during the check; no account data | Global edge network | EU-U.S. Data Privacy Framework and Standard Contractual Clauses |
Provider names link to their public data processing terms. First-party analytics run cookieless with no advertising, cross-site or fingerprinting scripts.
Data Processing Agreement
Our DPA follows GDPR Article 28 and includes the EU Standard Contractual Clauses (Module 2, controller to processor) for the transfers listed above, the sub-processor register with a change-notice commitment, the technical and organisational measures described on this page, and breach notification without undue delay. It is signed with every paid plan, Charter engagement and pilot, and available for review before you commit.
Controller and contacts
- Data controller
- SpecMake. Governing law: Italy.
- Privacy and security contact
- privacy@specmake.com for data-subject requests and security reports
Technical and organisational measures
What is in place today. We hold no third-party certification yet; the controls below are documented and can be walked through with your team.
Access control
Row-level security in the database: an account reads only its own rows; team members see shared documents through membership. Admin surfaces are limited to one operator account.
Secrets
Provider keys live in the hosting platform's encrypted environment, never in code. Connector credentials for your PIM are encrypted with AES-256-GCM before they are stored.
Private files
Private buckets only; every download uses a signed link that expires after one hour, and an upload link adds one file and expires after two hours
Transport and storage
TLS 1.2 or higher on every connection. Provider-managed encryption at rest; PIM connector credentials additionally encrypted with AES-256-GCM before storage.
Uploads
Every file is checked by signature, not extension, and capped at 20 MB (4.5 MB on the public readiness check and the API); ZIP-based formats are bounded against decompression attacks before parsing, so a DOCX or XLSX that expands past 100 MB once unpacked is refused. A file uploaded in the app passes through a private staging area and is removed from it when processing ends, and within 24 hours in any case.
Monitoring
Public health endpoint watched by an external uptime monitor; daily automated check of database policies and exposed functions; scheduled jobs carry a dead-man switch that alerts when they stop.
Backups
Automated daily database backups by the database provider
Authentication
Email and password with optional two-factor authentication; sessions refreshed server-side; account deletion requires an emailed confirmation link.
Your data, self-serve
Export
Settings, Security and account: download your account data (profile, preferences, consents, account events) in JSON.
Delete a document
Removes the database row, the stored source file and all extracted images in one operation.
Delete the account
Two-step, email-confirmed; removes documents, translations, glossaries, templates, files, audit data, support conversations and usage logs. Products a team member uploaded to a team stay with the team and pass to its owner.
Marketing consent
Off by default. Product updates only after opt-in; one-click unsubscribe in every message.
Retention in one line: your data stays while your account is active and is removed when you delete it; the full schedule is in the privacy policy.
Incidents and disclosure
Report a vulnerability or a suspected incident to privacy@specmake.com. We acknowledge within two business days, keep you informed while we investigate, and do not pursue good-faith researchers. Customers with a DPA are notified of a personal-data breach without undue delay. Service status is public at /status.