Security & Data Processing

Customer and SpecBrief responsibilities

How the service is protected

The controls below are the ones running in the service today.

Keeping each firm's work separate

• Every firm's held documents, briefs, reads and credit purchases are separated in the database by row-level security, so a query made for one firm cannot return another firm's rows.
• The application connects to the database as a restricted role that cannot bypass those rules and does not own the tables.
• An automated readiness check reads these settings from the live service every six hours and alerts us if any of them changes.

Signing in

• Passwords are stored only as scrypt hashes. New passwords must be at least 15 characters, or 12 when two-factor sign-in is on, and are checked against known breached passwords.
• Two-factor sign-in with an authenticator app is available for every account, and administrators who sign in with a password or email link must use it. Google and Microsoft sign-in, and single-use email links, are also offered.
• Repeated failed sign-ins slow down. Sign-in forms are protected against cross-site request forgery.
• Session cookies are marked Secure and HttpOnly. A sign-in lasts at most 14 days (12 hours if you don't choose to stay signed in) and ends after 3 days without use.
• Changing roles, removing people, managing API keys, changing document retention and deleting documents need a sign-in or confirmation within the last 15 minutes.
• You can see your signed-in devices and sign any of them out. Signing out ends the session on our server, and changing a password signs out every other device.

In the browser and on the network

• The site and the app are served only over HTTPS, and browsers are told to insist on it (HTTP Strict Transport Security).
• The app sends a strict Content Security Policy that only runs its own scripts, and it refuses to be framed by other sites.

Uploaded documents

• Only PDF, Word (.docx) and Excel (.xlsx) files are accepted. Macro-enabled files are not read. Scripts, links and attachments inside a document are never run, followed or opened, and the brief says where a document has them. Screening refuses files built to harm the service, such as archive bombs; it is not an antivirus scan and cannot detect every threat.
• Documents are opened in a separate process with limits on CPU time, memory and new processes. Python network calls are blocked. The worker shares the application's operating-system user; it is not a separate container or a complete sandbox, and native library code is not covered by the Python network block. These controls reduce the impact of malformed files but do not guarantee containment.
• Upload and reading limits cap the size of any one pack.

Backups and recovery

• The database is backed up every night. Each backup is encrypted with AES-256 before it is stored, and encrypted copies are kept for 30 days.

How the software is built

• Application and public-page pull requests run automated tests. Documentation-only pull requests can skip those checks, and the full suite also runs on the main branch every week.
• The CI workflow scans the full Git history for leaked secrets and checks pinned dependencies against published vulnerability advisories when it runs, including on its weekly schedule. These checks do not prove that the software has no vulnerabilities.
• When optional error reporting is enabled, reports are filtered to remove personal data. This filtering does not guarantee that every sensitive value will be recognised.

Access by SpecBrief

• Administrative access to customer data is limited to support, security, deletion and legal needs, and the reason for each access is recorded.

Security incidents

If SpecBrief becomes aware of a security incident affecting a customer's data, it will notify the account's administrators without undue delay and share what it knows: what happened, which data and accounts are affected so far as that is known, what has been done to contain it, and what the customer may need to do. Where the Notifiable Data Breaches scheme applies, SpecBrief will also notify affected individuals and the Office of the Australian Information Commissioner as that scheme requires, and it will help a customer with any notice the customer must give. The Data Processing Schedule sets out these commitments in full.

Report a security issue

Email security@specbrief.com.au. Describe the issue, the affected URL or account, and enough detail for us to reproduce or contain it. Do not include passwords, access tokens or tender documents in the first message.

If you are researching in good faith, please:

• only use accounts you own, and never access, change or keep another firm's data;
• stop and report as soon as you find a problem, and do not use it further;
• do not disrupt the service, run denial-of-service or load tests, or use social engineering or physical attacks;
• give us a reasonable time to fix the issue before you tell anyone else about it.

We will acknowledge your report, keep you informed while we work on it, and credit you if you would like us to. We do not currently pay rewards for reports.

What this page does not claim

SpecBrief does not currently hold a security certification such as ISO 27001 or a SOC 2 report, and this page is not a certification statement. No system is completely secure, and the controls above reduce risk rather than remove it. Customer documents are read by a paid commercial AI service, so overseas processing remains part of the service, as described above and in the Privacy & Data Handling notice.

Current processors and regions

Official provider documents: Google Gemini API, Render, Supabase, Resend, Google identity, Microsoft identity, Cloudflare, Vercel and Sentry.

Access, retention and deletion

Generated briefs normally expire after 30 days. Raw uploads are temporary. When SpecBrief sends the pages of a PDF to the AI service, it holds the original file until the read ends, even if the customer has not chosen to retain packs, and deletes it when the read ends or the quote expires. A customer can elect to retain a pack for a defined period, but that option is off by default and current storage is not an archive. Database backup artifacts are encrypted and age out after 30 days. See the Privacy & Data Handling notice for the detailed retention position.