Back to SpecMind

Security

Last updated: August 17, 2026.

SpecMind ("we", "our", "us") builds inspection software. This page explains how we protect the data inspectors and their clients entrust to us. We take this seriously — inspection reports often contain sensitive details about a home, a transaction, and the people involved.

Data residency & hosting

SpecMind runs on managed infrastructure in U.S. data centers. The primary database is PostgreSQL, hosted by Supabase. Application services are hosted by Railway. Photos and PDF reports are stored in encrypted object storage. All cross-region traffic uses TLS 1.2+.

Encryption

  • In transit. All connections to SpecMind use HTTPS with TLS 1.2 or higher. We enforce HSTS on all public domains.
  • At rest. Database storage and object storage (for photos, report PDFs, signature images) are encrypted at rest using AES-256.
  • Backups. Daily encrypted backups of the database are retained with point-in-time recovery for the most recent 7 days.

Authentication & access

  • Inspector and team accounts use email + password authentication with bcrypt-hashed credentials. Magic-link sign-in is supported on iOS.
  • Session tokens are signed JWTs with short-lived access tokens and longer-lived refresh tokens. Tokens are revoked on logout.
  • Internal access to production systems is gated by SSO and two-factor authentication. Audit logs are kept for all admin actions.
  • Service-role database access is restricted to backend services only. No human operator queries production data directly except for verified incident response.

Tenant isolation

SpecMind is multi-tenant. Inspectors and their teams cannot see each other's data. Tenant isolation is enforced at the application layer through an ownership filter applied to every database query — inspection, report, contact, agreement, payment, and template. Team members see only the inspections their company owns.

Payments

Payments are processed by Stripe. SpecMind does not store credit card numbers or bank routing details. Stripe is a PCI-DSS Level 1 certified provider; their compliance reporting covers the payment path end-to-end.

AI features

AI-assisted features send inspection content to our AI providers, currently Anthropic (comment enhancement, quick log, watch lists, pre-departure checklists) and OpenAI (template generation, photo comment vision, PDF import). Depending on the feature, this can include inspector-authored text, inspection photographs, and property details. AI provider request/response data is not used to train their general models per our provider agreements; see the Privacy Policy (AI-Specific Data Practices) for the full description of what each feature transmits.

Vulnerability disclosure

If you believe you've found a security vulnerability in SpecMind, please email security@specmind.ai. We respond to all good-faith reports within 1 business day and aim to triage critical issues within 24 hours of confirmation.

Subprocessors

SpecMind uses a small set of vetted subprocessors to deliver the service. The current list:

  • Supabase (PostgreSQL hosting, object storage)
  • Railway (application hosting)
  • Stripe (payment processing)
  • Anthropic (AI features)
  • OpenAI (AI features)
  • RentCast (property data enrichment — receives property addresses)
  • Google (Street View imagery — receives property addresses; Google Analytics on the marketing site)
  • PostHog (product analytics on the marketing site)
  • Resend (transactional email delivery)
  • Twilio (optional SMS notifications)

Material changes to this list are reflected on this page and notified to enterprise customers under DPA.

Compliance status

SpecMind is not currently SOC 2 certified. We follow SOC 2 Type I-aligned controls and intend to pursue formal certification as we scale. Customers with specific compliance requirements (HIPAA, SOC 2, ISO 27001) should email security@specmind.ai to discuss.

Questions

Questions about our security posture? Email security@specmind.ai.