Security and data handling

How data flows

1. Your documents stay in your SharePoint. Spectivon reads them through Microsoft Graph, read-only, with each user's own sign-in.
2. Spectivon opens each document directly from SharePoint, the way a browser opens a file to display it, and pulls out the text. Only that text is kept; the file itself is never saved. Scanned pages are sent to Microsoft Azure Document Intelligence, which returns their text and deletes its results within 24 hours, and pages that are mainly maps or figures may be sent to the AI model as images to be read, then not kept.
3. What persists in Spectivon's database: extracted text passages and their embeddings (numeric representations of each passage, used for search); AI-derived findings, permits, permit conditions, and proposed schedule dates; project metadata; Q&A items; chat history; and the audit log of scan and document events. After each scan, a backup copy of the risk findings is also kept so they can be restored if a scan goes wrong. It is stored alongside the database, encrypted at rest, and only Spectivon's backend service can access it. It is not available through the application. Screenshots a user chooses to attach to in-app feedback are handled the same way. If File Audit is used, Spectivon also keeps an inventory of the audited folders: file names, paths, dates, and an AI reading of each file's type and draft or final status.
4. Once a day, Spectivon checks connected folders for new and changed documents, using the connecting user's stored, encrypted access token.

What Spectivon never stores

• Data room document files, in any format, in the database or in file storage. They remain in your SharePoint at all times.
• Anything from a third-party data room. Spectivon connects to no data room service and reads only what your team places in your SharePoint.

Personal contact information

• Pages that are contact lists (public-meeting sign-in sheets, attendee rosters, landowner and outreach contact lists), whether typed or scanned, are left out whole. They are not stored and are not used in search, chat, or risk and permit analysis. Spectivon shows which pages were left out, by document and page number, so the gap stays visible.
• Email addresses and phone numbers are removed from the stored text and from AI results, in every file type.

How Spectivon accesses SharePoint

• A user signs in with their own Microsoft 365 account. Spectivon never sees that user's password and can read only the content that user can already open.
• Permissions requested: Files.Read and User.Read, plus offline access so the daily update check can run. These are standard, read-only permissions on the user's own account; no mail, calendar, or Teams access is requested.
• Access is read-only. Spectivon does not write to, modify, or delete files in SharePoint.
• First-time approval: only delegated permissions are used, so no app-level access is granted. Whether a user can approve them alone depends on your Microsoft 365 tenant's consent settings. If your tenant restricts user consent to apps, your administrator approves Spectivon once for the organization.
• Access can be revoked at any time: with Disconnect Microsoft in Spectivon's account menu, which deletes the stored token, or by your IT team in Microsoft Entra ID, like any other Microsoft 365 app. Once revoked, no further reads are possible.

Encryption, isolation, and access control

• In transit: all traffic uses HTTPS.
• At rest: the database and hosting providers encrypt stored data at rest. Microsoft access and refresh tokens are additionally encrypted at the application layer (AES-256-GCM) before they are stored.
• Access: each company's data can be read only by that company's users. This is enforced by row-level security on every database table, in the database itself, not only by application logic.
• Accounts: accounts are provisioned by Spectivon for each organization. There is no self-serve signup.
• Audit log: Spectivon records, with user and time, each SharePoint connection, document indexed or removed, scan, memo, project deletion, and administrative reindex. Entries cannot be edited or deleted from the application, and your log is available on request.

Where data is processed

• Application hosting: US regions.
• Database: PostgreSQL, US East (Northern Virginia).
• OCR for scanned pages, when needed: Microsoft Azure Document Intelligence, East US.
• AI models: Anthropic API, called directly.
• Embeddings: OpenAI API, called directly, used only to generate embeddings for indexed text and never for generative output.
• Background job processing: eastern US. Document text and results pass through it between processing steps and are kept for 1 day.

AI and your data

All model calls run under each provider's commercial API terms, not consumer terms. Under those terms, neither Anthropic nor OpenAI trains models on API inputs or outputs. Both keep API data for up to 30 days by default, unless a separate agreement such as zero data retention applies. Azure Document Intelligence deletes OCR results within 24 hours, and background job history is kept for 1 day. OpenAI is used only to compute embeddings, never to generate text. Provider terms change; the current terms of each provider govern.

Page last reviewed: 2026-10-03.

Providers and certifications

Spectivon runs on infrastructure and AI providers that each hold SOC 2 Type II attestation, including Microsoft Azure (SharePoint access and OCR) and Anthropic (AI models). OpenAI provides embeddings only. A current subprocessor list is available on request.

Spectivon's own SOC 2 certification is planned, not yet held. The controls described on this page are in place today.

Commitments

• All of your data is deleted within 30 days of contract termination or a written request.
• Notification within 72 hours of becoming aware of a breach affecting your data.

Security questionnaire and overview

A Security and Data Handling Overview is available on request, and Spectivon will complete your standard vendor security questionnaire or walk your team through any of the above. Contact hello@spectivon.com.