SpikedAI Trust & Security
Your Digital Colleagues work with your most sensitive conversations, so protection is built in from the first login. Your data is encrypted, isolated to your organization and never used to train AI models.
- Never used for AI training
- AES-256 at rest
- TLS 1.2+ in transit
- Tenant isolation
- MFA & role-based access
- DPA with SCCs
Never used to train AI models
Your conversations, documents and CRM data are never used to train foundation or generalized AI models, and never sold or used for advertising.
Encrypted everywhere
Data is encrypted in transit with TLS 1.2+ and at rest with AES-256, on Google Cloud and Supabase.
Isolated to your organization
Every record is scoped to your organization, with Row-Level Security enforced at the database layer.
Every answer shows its sources
Answers are grounded in your own documents and list the files behind them. When your documents don’t cover a question, SpikedAI flags the gap.
01Built on Google Cloud. Designed for availability.
SpikedAI runs on managed, certified cloud infrastructure in the United States, with redundancy and backups across production environments.
Google Cloud Platform
Application workloads run on Cloud Run in us-central1 (Iowa), with isolated networking and Google’s global perimeter defenses.
Supabase
Database and authentication run on Supabase (PostgreSQL) in the United States, with JWT-based sessions.
Automated backups
Daily database backups and point-in-time recovery, with 7-day retention across production environments.
- Hosting
- Google Cloud, us-central1
- Database & auth
- Supabase (US)
- Redundancy
- Multi-zone
- Encryption
- AES-256 / TLS 1.2+
- Uptime target
- 99.9%
02Encrypted and isolated by default.
Personal information and conversation data are protected at every layer, from the network to each database row.
Encryption
All customer data is encrypted in transit over public networks with TLS 1.2+. Data at rest is encrypted with provider-managed AES-256 keys on Google Cloud Storage and Supabase (PostgreSQL).
- FIPS 140-2 validated cryptography (Google Cloud)
- Perfect Forward Secrecy
Tenant isolation
Every database record is scoped to your organization ID, and Row-Level Security (RLS) is enforced at the database layer, so one organization’s data stays out of another’s queries.
- Organization-scoped records
- Tenant-scoped access tokens
03The right people, with the right access.
Control who signs in, what they can see and what they can change.
Multi-factor authentication
Protect every account with MFA at sign-in, alongside session and access checks on every request.
Role-based access
Owners invite teammates and manage seats and credits. Members see their own work and allocation, and request more when they need it.
Your team stays in charge
Business decisions such as follow-ups sent to customers, discounts and pricing exceptions are held for your review and approval.
04Clear boundaries on AI.
SpikedAI uses leading generative models while keeping strict boundaries on how your data is used.
SpikedAI never uses customer data to train foundation or generalized AI models.
Vetted AI providers
AI processing runs through Google’s enterprise Gemini models under terms that keep your data out of model training.
Grounded in your sources
Answers come from your organization’s own documents through retrieval-augmented generation, so they stay accurate and traceable to their sources.
Answer Verification
When your documents don’t cover a question, SpikedAI flags the gap instead of filling it, and unanswered questions are routed for verification.
05Least-privilege by design.
Integrations are opt-in, user-authorized, and request the narrowest scope that makes the feature work.
Google Calendar (Read-Only)
The Google Calendar integration is opt-in and authorized by the user
through Google's OAuth consent screen. We request a single
read-only scope, calendar.readonly, so SpikedAI can see upcoming
meetings, attendees, and timing, and prepare account context before
a call. SpikedAI never creates, edits, or deletes events.
- Read-only scope, no write access
- Revocable anytime from your Google Account
Google Limited Use
SpikedAI's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. Calendar data is used only to provide user-facing features.
- Never sold or used for advertising
- Never used to train generalized AI models
Full detail on the calendar data we access and how long we keep it is in our Privacy Policy.
06Your data, on your terms.
Deletion on request
Request deletion of your organization’s content at any time, subject to your contract and legal obligations.
Calendar data
When you disconnect Google Calendar, previously retrieved calendar data is deleted within 30 days.
Revocable integrations
Disconnect any integration from SpikedAI or from the provider’s own account settings at any time.
07Who processes your data.
We work with a small set of established providers, each vetted for security and privacy commitments.
| Provider | Purpose | Location |
|---|---|---|
| Google Cloud | Application hosting, storage and Gemini AI models | United States |
| Supabase | Database and authentication | United States |
| Stripe | Payments and billing | United States |
Request the complete, current subprocessor list from [email protected].
08Built on certified infrastructure.
Our posture
SpikedAI is building its security program toward SOC 2. We follow common cloud security and OWASP practices across our development lifecycle.
Inherited from our providers
The infrastructure SpikedAI runs on is independently audited:
- Google Cloud: SOC 2 Type II, ISO 27001, PCI DSS
- Supabase: SOC 2 Type II
Found a vulnerability? Tell us.
We work with independent security researchers and take every report seriously. Each report is triaged by severity and fixed, with high-severity issues prioritized.
Report a security issueData Processing Agreement
SpikedAI offers a standard DPA, including Standard Contractual Clauses (SCCs), to protect your data across jurisdictions.
- GDPR Article 28
- Data breach notification
- International transfer safeguards