SpeqForge
Security

Built with security from the ground up

Your data, including feedback, specs, and customer insights, is sensitive. Here is exactly how we protect it.

Encryption everywhere

All data in transit is encrypted with TLS 1.2+. The database is encrypted at rest with AES-256, and every API key and OAuth token you store is separately encrypted before it is written, under a key that can be rotated. Backups are encrypted with AES-256 under a third key.

Strict data isolation

Every workspace is isolated at the data layer. Your feedback, specs, and connected account data are never shared with or visible to other workspaces or customers. Cross-tenant access is covered by an automated test suite that runs on every change.

Access control

Authentication uses signed JWTs: a short-lived access token plus a revocable refresh token. Passwords are hashed with bcrypt. Every authenticated request verifies ownership or workspace membership before returning or changing data. Share links, feedback portals and inbound webhooks are signature-verified or gated on a secret you control.

Infrastructure

SpeqForge runs on dedicated infrastructure. We do not share compute or storage with other tenants. Encrypted backups run daily, are retained for 7 days, and are taken before every deployment.

Security practices

  • TLS 1.2+ for all connections
  • AES-256 encryption at rest
  • Encrypted credential storage with key rotation
  • AES-256 encrypted backups
  • Signature-verified inbound webhooks
  • bcrypt password hashing
  • Short-lived access tokens with revocable refresh tokens
  • Per-workspace data isolation
  • Credential scrubbing in logs
  • Rate limiting on all sensitive endpoints
  • Webhook token rotation on demand
  • Daily automated backups
  • Dependency vulnerability scanning
  • Automated security scanning on every change

AI processing

SpeqForge uses AI APIs to analyze your data. Content you submit is sent to the AI provider strictly to generate the output you requested. It is not used to train models and is not retained by the provider beyond the duration of the request, per their data processing terms. We do not store raw prompts or completions in logs.

Compliance roadmap

We are actively working toward SOC 2 Type II certification. If your organization has specific compliance requirements such as GDPR data processing agreements, security questionnaires, or custom contractual terms, reach out and we will work with you directly.

Report a vulnerability

Found a security issue? Please disclose it responsibly. We take all reports seriously and respond within 48 hours.

security@speqforge.com