Spatial MapSpatial Map
Security

Security is a product feature, not a compliance afterthought.

The platform is multi-tenant from line one, every role is gated, every action is logged. Here's exactly how we do it.

Encryption
TLS 1.3 in transit. AES-256 at rest. Application-level encryption for sensitive attributes like API keys and webhook secrets.
Access control
Per-tenant data isolation enforced at the platform layer. Four-role RBAC (Owner / Admin / Editor / Viewer) on every destructive action. SSO available on enterprise plans.
Hosting
US-region cloud hosting with redundant zones. Daily backups, 30-day retention, point-in-time recovery up to the last 7 days.
Audit & logging
Every authentication and admin action is logged. Workspace owners can export an audit trail from the members screen. Logs retained for 365 days.
People & process
Least-privilege access for our team — production data is reachable only by on-call engineers, only with a logged justification, only for break-glass scenarios.
Resilience
Multi-zone failover for the API. Live data channel auto-reconnects with replay from a cursor. We test the disaster-recovery runbook quarterly.
Compliance & certifications

Where we are on the certifications buyers care about.

Honest status, no “coming soon” bunny suits.

Standard
Status
Notes
SOC 2 Type II
In progress
Audit window opens Q3 2026.
ISO 27001
Planned
Targeted for 2027.
GDPR-aligned
Live
DPA available, EU SCCs supported.
CCPA-aligned
Live
Subject-access requests handled within 30 days.
HIPAA
Not applicable
Spatial Map is not designed to process PHI.
Responsible disclosure

Found a vulnerability? We'd love to hear from you.

We take security reports seriously and acknowledge every one within one business day.

How to report

  1. 1Email [email protected] with a description of the issue.
  2. 2Include the steps to reproduce, the impact, and any proof-of-concept.
  3. 3Please give us 90 days to remediate before any public disclosure.
  4. 4We will keep you updated and credit you publicly (if you want).
[email protected]

Need security review materials?

We'll share our latest security questionnaire, DPA, and subprocessor list under NDA.