Security

Security, stated plainly.

SpecIndex reads public construction documents. The private data we hold is account, workspace and API key data, and the files a customer uploads for a spec check, which are kept in a separate storage bucket with public access prevention, apart from the public corpus. This page describes how that data is protected, what is monitored, how recovery works, and, in its own section near the end, what we do not claim yet.

Last updated October 13, 2026.

What we hold

Public source data: Bid solicitations, project manuals, addenda and related documents published by public agencies and procurement portals. We do not access private systems, and we do not resell the source documents. We publish the facts extracted from them, each with a citation back to where it was found.
Customer data: Account details, workspace data such as saved and tracked projects and notes, and API keys with the entitlements attached to them. What account and usage data we collect, and why, is described in full in the Privacy Policy.
Private uploads: Documents a customer uploads for a spec check are stored in a separate storage bucket with public access prevention, apart from the public corpus.

Account and usage data is described in full in our Privacy Policy. Payment details, when a subscription is active, are handled by our payment processor and are not stored on SpecIndex’s own servers.

Who can get in

Authentication: Sign in runs through Firebase Authentication. SpecIndex never receives or stores your password; Firebase handles authentication directly.
API keys fail closed: A key with no entitlement record is entitled to nothing. A self service key returns no data until it has been provisioned, and an entitlement has to be granted explicitly, never by omission.
Staff surfaces: Internal and operations surfaces are access controlled on the server, not just hidden in the interface. Every operations endpoint requires a verified sign in plus a staff role record, and the staff interface itself fails closed when it cannot confirm a role.

Protecting the public surface

The public API is rate limited per client IP on each API instance, and the heaviest routes, the ones that scan the corpus, carry a lower limit. Carrying a credential header buys no exemption: only a verified build token, used by our own site builds and compared in constant time, is exempt from the per IP limit, and it still passes through the in flight cap below.

Heavy requests are also capped in flight per instance, so a flood of corpus scans cannot consume the whole shared database pool. Capacity stays reserved for health checks, the site and the signed in app. Pool state, connections in use, waits and rejections, is reported on the API health endpoint, where the uptime checks described below can see it.

Monitoring

Uptime checks verify response content, not just an HTTP status, across the API, the corpus and brand check endpoints and the site itself, from multiple regions. A database outage that still answers HTTP 200 is exactly the case those checks exist to catch.

Latency and error log alerts notify the team by email, and errors from the browser are captured for the same team. There is no public status page today; this section describes the monitoring itself, nothing more.

Backup and recovery

The production database is backed up automatically every day, with seven backups retained. Point in time recovery is on, with seven days of logs, and deletion protection is on, so the database cannot be deleted without that protection being turned off deliberately first.

Restores are rehearsed, not assumed. In October 2026 a rehearsal restored the production backup into a throwaway instance and produced a verified copy in about eight minutes. That is a measured rehearsal result, not a recovery time promise.

Stated plainly: the database runs in a single zone with no replica, so a zone outage would mean downtime until a restore completes.

Encryption and hosting

SpecIndex runs on Google Cloud: the site on Firebase Hosting, the API on Cloud Run, the database on Cloud SQL for Postgres, and documents in Google Cloud Storage. Data is encrypted in transit over HTTPS and encrypted at rest, in both cases as provided by Google Cloud.

Not yet, stated plainly

SOC 2: SpecIndex does not hold SOC 2 certification today. If your review needs one, ask us and we will tell you exactly where that stands rather than let this page imply it.
SSO and SAML: Not offered today. Sign in is through Firebase Authentication, with Google or email. Single sign on is on our roadmap, not in the product.
Penetration testing: We make no penetration test claim on this page and have no test report to share today.

Questions and reports

Running a vendor or security review? Our vendor packet is available on request. Email [email protected] and we will send what your review needs.

If you believe you’ve found a security issue with SpecIndex, email [email protected] with details. We take reports seriously and will respond directly.