Security

Security is part of how SPX is designed, operated, and supported. We use layered controls to protect the platform and the data that flows through it.

This page summarizes the security posture we aim to maintain for the product and its supporting services.

We keep production access limited to authorized team members and expect sensitive actions to be gated by least-privilege permissions and review.

Administrative access should be restricted, logged, and removed when it is no longer needed.

We use secure transport for data moving between the browser, the app, and third-party services, and we expect sensitive data to be protected at rest where it is stored.

The exact controls depend on the service layer involved, but the goal is consistent: reduce exposure while keeping the product usable.

We rely on monitoring and operational logs to detect errors, abuse, service degradation, and security-relevant events.

Logs should be limited to what is needed to operate the service and investigate incidents.

We expect to maintain backups or recovery mechanisms for critical service data so that we can restore availability after a failure or operational mistake.

Recovery procedures should be tested often enough to remain useful when they matter.

If you believe you have found a security issue in SPX, please report it responsibly and give us enough detail to reproduce the problem.

We treat good-faith security reports as high priority and will review them promptly.

When a security incident occurs, our goal is to contain the issue, understand scope, remediate the problem, and communicate appropriately to impacted users.

We will keep response steps practical and focused on protecting users and the service.

Security controls evolve as the product grows, so this page may be updated over time.

For security questions or reports, contact us at the address below.