Skip to content
SparQ

Trust Center

Security you can verify, not just read about.

This page describes how SparQ is built to protect your data and your customers' data, which parts are available today, and what we do not claim yet.

Eight invariants that no setting turns off

They hold for every workspace, agent and call, and are compiled into the platform.

  1. 01Authentication, and the credential recorded, on every action
  2. 02Isolation of workspace, project and client in data, cache, traces and budgets
  3. 03The tool gateway on every tool call, with default deny
  4. 04Approval for writes, and two people for destructive actions in production
  5. 05Hard limits on every run
  6. 06Audit writes that fail closed
  7. 07No credentials in model context, run state or traces
  8. 08Prompt and response content off by default in telemetry

Security controls

  • Row-level security that no role bypasses

    Early access

    Every table enforces row-level security, global tables included, and the build fails if a new table does not. No SparQ database role can bypass it, and a query without a tenant scope matches nothing.

  • Keys that are never stored

    Early access

    API keys are shown once. SparQ stores an HMAC with a pepper that never enters the database. A revoked key is refused within 30 seconds; measured at about 10.

  • Your identity provider, verified properly

    Early access

    User tokens must be RS256 or ES256 with issuer, audience, expiry and subject checked. Symmetric algorithms are refused. Users get pseudonymous ids.

  • Fail closed

    Early access

    Authorization, model routing and audit writes deny when they are unsure. A rate limiter that cannot be reached refuses the request instead of waving it through.

  • Credentials stay out of the model

    Early access

    No credential ever enters model context, run state, checkpoints or traces. Provider keys are referenced by name in the registry; inline keys are refused.

  • Access scoped per environment

    Next release

    A key for development is refused by production. Production access is never implied by an older grant, and elevation is just-in-time with a second approver.

  • Two people for what matters

    Next release

    Publishing to production needs a second admin; the author cannot approve their own change. Destructive actions in production always need a person.

  • Egress you control

    Next release

    Tool calls run under an egress allowlist with SSRF and DNS-rebinding defences. Private and cloud metadata addresses are denied.

Data handling

SparQ separates where it is configured from where your data lives. The split below is the design every deployment follows.

What the control plane holds
Configuration, credentials as hashes, grants, settings, compliance profiles, the model registry, Releases and the administrative audit. It never reads conversation, run or knowledge content.
What a stamp holds
Conversations, runs, files, knowledge and vectors, the usage ledger and the runtime audit. Personal data in a stamp does not leave its geo.
What the directory holds
Opaque placement ids and region codes, so a request reaches the right geo. No conversation content and no customer names in global DNS.
Retention
Set per workspace, with 180 days as the default for conversations. A client's compliance profile can shorten retention, never extend it.

Compliance mapping

Each control area, the safeguards that implement it, and the framework references it is designed to meet. This is an indicative mapping: the full control catalogue, with an owner, evidence and review cadence for every control, is being completed.

Identity and access

Early access
  • API keys shown once, stored as a peppered HMAC, revoked within 30 seconds
  • Asymmetric sign-in tokens only (RS256, ES256), with issuer, audience and expiry checked
  • Default-deny authorization; every decision recorded with its policy version
  • ISO 27001 A.5.15 to A.5.18
  • ISO 27001 A.8.2
  • SOC 2 CC6.1 to CC6.3
  • GDPR Art. 32

Isolation and data protection

Early access
  • Forced row-level security on every table; no database role bypasses it
  • Workspace, project and client isolation in data, cache, traces and budgets
  • Roadmap: encryption with a key per client, and customer-managed keys
  • ISO 27001 A.8.3
  • ISO 27001 A.8.24
  • SOC 2 CC6.1
  • SOC 2 C1.1
  • GDPR Art. 25
  • DPDP s. 8(5)

Residency and transfers

Early access
  • Compliance profile per client; routing fails closed when no compliant model exists
  • A control plane per geo and data planes that keep content inside it
  • Disaster recovery to a paired region in the same geo, never across a border
  • ISO 27001 A.5.23
  • GDPR Art. 44 to 49
  • DPDP s. 16

Logging and audit

Early access
  • Append-only audit chained by hash per workspace, written in the action's own transaction
  • A verifier for changed, removed and re-hashed records
  • The credential that caused it on every request, cost row and audit record
  • ISO 27001 A.8.15
  • ISO 27001 A.8.16
  • SOC 2 CC7.2
  • GDPR Art. 5(2)

Change management

Next release
  • Immutable Releases, promoted and rolled back as a whole
  • A second admin approves; the author cannot approve their own change
  • Evaluation suites gate promotion to each environment
  • ISO 27001 A.8.32
  • SOC 2 CC8.1
  • ISO 42001 A.6
  • NIST AI RMF Manage

AI system controls

Next release
  • Hard limits on model calls, tool calls, delegation depth and run time
  • Approval for writes and destructive actions; kill switches per agent, client, credential and project
  • Injection screening of retrieved content and tool output; tools reached only through the tool gateway
  • ISO 42001 A.6
  • ISO 42001 A.9
  • NIST AI RMF Map, Measure, Manage
  • OWASP Agentic Top 10

Suppliers

Early access
  • A model registry recording each deployment's provider, region and retention terms
  • Clients can require zero-retention providers in their compliance profile
  • A published list of sub-processors
  • ISO 27001 A.5.19 to A.5.22
  • SOC 2 CC9.2
  • GDPR Art. 28
  • ISO 42001 A.10

Telemetry and privacy

Early access
  • Prompt and response content off by default in traces
  • Content policy per trace destination, with an approver for full content
  • Pseudonymous user ids derived from the issuer and subject
  • GDPR Art. 5(1)(c)
  • GDPR Art. 25
  • ISO 27001 A.5.34
  • ISO 27001 A.8.12

What we do not claim yet

SparQ is in early access. To be precise about where we are:

  • Certification against ISO/IEC 27001, ISO/IEC 42001 or SOC 2. We will publish each certification when it is earned from operating evidence.
  • An availability commitment. Service levels will be agreed per contract once production stamps are operating.
  • Erasure guarantees, until restore-and-replay tests show deleted data stays deleted.
  • Support for model providers beyond Azure OpenAI and OpenAI-compatible endpoints.

Report a vulnerability

If you believe you have found a security issue in SparQ, please tell us privately. We acknowledge reports within three business days and will keep you informed until it is resolved. Please do not access data that is not yours, and give us reasonable time to fix the issue before disclosing it.

security@sparqhq.aisecurity.txtSub-processors