Security & Trust
Specula builds websites, business intelligence tools, and connected workflows. We define security requirements around the data and access each project needs, and communicate what is included, who is responsible, and what requires ongoing care.
Clear, practical, and improving with every release.
CSV imports are validated before they become dashboard metrics.
Uploaded data is attached to the signed-in user's organization.
Admins and owners control company-level workspace settings.
The platform focuses on operating metrics needed for analysis and avoids unnecessary sensitive details.
Customer metrics are scoped to an organization workspace, and app queries include the active organization boundary.
Specula uses Supabase Auth for account sessions and avoids handling passwords directly in application code.
Production deployments use HTTPS so data is protected while moving between the browser and the app.
API keys and database credentials live in environment variables, not source files or public client code.
Website & automation projects
The platform safeguards above describe Specula’s own application. Client websites and automations have their own hosting, tools, and access requirements. We document the applicable controls and responsibilities in each project agreement; no website or integration can be guaranteed free of security risks.
We define the security requirements for each build, including HTTPS, protected administrator access, server-side input validation, and appropriate spam controls. When payments are included, we integrate a payment provider’s supported checkout rather than store card details in the website.
Connections require the client’s authorization and suitable permissions. We agree on which systems and data a workflow can access, use the minimum permissions the integration supports, and define approval steps for sensitive actions. Compatibility and access requirements are confirmed before implementation.
Private credentials belong in server-side configuration or an appropriate secrets service. Project handover identifies account ownership, administrator access, and how project access should be removed when it is no longer needed. Clients retain responsibility for the accounts and permissions they control.
The project agreement identifies who handles software updates, backups, recovery, monitoring, and security-related support. These services and their frequency depend on the agreed scope and hosting setup; ongoing maintenance and continuous monitoring are not automatically included with a website launch.
Have specific security requirements? Discuss them with Specula before we finalize your project scope.
Security commitments
Specula does not claim SOC 2, HIPAA, or other certifications until they are actually complete. Today, the promise is practical: customer data is treated as sensitive, access is scoped by workspace and role, secrets stay out of source code, and security improvements remain visible as the platform matures.
CSV imports are validated before they become dashboard metrics.
Uploaded data is attached to the signed-in user's organization.
Admins and owners control company-level workspace settings.
The platform focuses on operating metrics needed for analysis and avoids unnecessary sensitive details.
Production secrets are managed outside the public app and rotated when needed.
Database access controls and organization boundaries are reviewed as the service matures.
