Spend by Product Exec Trust
Security your RFP can check line by line.
Each answer below points to code that implements it. Hosting regions, backups, uptime and response times are proposed service terms, confirmed in each contract.
Hosting
- Single tenant per database: each customer gets its own application instance, Postgres database and document bucket, encrypted at rest.
- US cloud regions, with AWS GovCloud (US) or Azure Government available. The same build can run in a customer's own cloud account.
- Only the load balancer is reachable from the internet, on HTTPS port 443.
- Daily encrypted backups kept 35 days, with a copy in a second region under a separate key.
Encryption
- TLS 1.2 or later everywhere, HSTS, and every connector refuses non-HTTPS endpoints.
- Every record, ledger event and stored file is encrypted with AES-256-GCM under the tenant's own data key before it is written.
- Data keys are wrapped by AWS KMS, optionally a customer-owned key: disable it and every copy, including backups, is unreadable.
- Ciphertext is bound to its tenant, collection and record, so a copied or edited row fails to decrypt.
- Sessions are stored only as hashes of their tokens.
Identity and access
- OpenID Connect with PKCE or SAML 2.0, with Entra ID, Okta, Ping, ADFS or Google Workspace, and an optional multi-factor requirement.
- SCIM 2.0 provisioning, with directory groups mapped to roles and segregation of duties checked on every change.
- No self-provisioning: only people your administrators set up can sign in. Refused sign-ins are recorded.
- Approval limits, no self-approval, and the same checks for delegates and the people they cover for.
Audit trail
- A per-tenant, hash-chained ledger of every action, verifiable at any time.
- Every hour each ledger head is signed and sent to your SIEM, so even a rewritten and re-hashed history is detected.
- A security event feed in JSON, CEF or OCSF for sign-ins, role changes, agent tokens, bank changes, legal holds and exports.
- Legal holds, retention schedules, disposition with approval, and access reviews.
AI
- Agents can never approve, award, release payments or change policy.
- Document classes you name, such as BES Cyber System Information, are never sent to the AI provider; they go to a person instead, and the skip is logged.
- AI runs on Anthropic's Claude under commercial terms that do not train on customer data. We do not use customer data to train models.
- For each AI call the ledger keeps the model, prompt version and input digest.
Your data, your exit
- Administrators can export everything at any time: every record, document and the full ledger as NDJSON with counts and a checksum.
- After contract end, data is kept 30 days for a final export, then the tenant's key is destroyed and the destruction certified.
- We act as a service provider under the CCPA and use customer data only to deliver the service.
Service terms we propose
Recovery, uptime and response
99.9%monthly uptime target, excluding announced maintenance
8 hoursrecovery time objective
24 hoursrecovery point from daily backups; minutes with point-in-time recovery
24 hoursto notify you of a suspected breach, from detection
We commit to a third-party penetration test before go-live and yearly after, critical findings fixed in 7 days and high in 30. SOC 2 Type II audit is planned; the control mapping is published.
Compliance map
Controls mapped to the regulations you answer to
| Framework | What Spend enforces |
|---|---|
| NERC CIP-013-2 | Vendor risk in procurement planning, the six R1.2 contract terms, security officer approval and review dates. |
| 2 CFR 200 | Conflict-of-interest attestations, procurement records, full and open competition, methods and thresholds, cost and price analysis, bonding and Appendix II provisions. |
| SOC 2 criteria | Logical access, segregation of duties, monitoring, change management of policy and processing integrity of AI output. Type II audit planned. |
| California Public Contract Code | Retention capped at 5% (§7201), released within 60 days (§7107), progress payment timing (§20104.50). |
| California labor and lien law | Certified payrolls (Labor Code §1776) and statutory lien waivers (Civil Code §8132–§8138). |
| IRS 1099 | 1099-NEC and MISC totals by payment date with TIN and address validation. |
A starting point for auditors; confirm citations against current regulations.
Accessibility
The web app and phone view are tested against WCAG 2.2 A and AA with automated scans in light and dark themes, at desktop and phone sizes. A draft accessibility conformance report (VPAT 2.5) is available on request; manual screen reader testing is scheduled before go-live.
Send us your security questionnaire
We answer from the code, with pointers to where each control lives.