Security

How spawnpoint protects your account, your apps, and their data: encryption, backups, who can reach your data, and where it lives.

Accounts & tokens

• Passwordless login. You sign in with a link sent to your email, or with your Google account, so there is no spawnpoint password to leak.
• Tokens stored as hashes. We store only a hash of each API token. You see the full token once, when you create it, and we cannot recover it.
• Revoke anytime. Revoke a token or terminate a project from the console and it stops working immediately.

Isolation

Each project with a server runs in its own virtual machine, which we manage. Projects do not share a machine, so one project cannot reach into another. Each machine sits in our private network on Amazon Web Services with no public address and no way to log in to it: visitors reach an app only through spawnpoint, and one app's machine cannot reach another's. A static project (pages with no server code) has no machine: we serve its files from our storage.

Encryption

Every connection to the console, the MCP server, and your apps' links uses TLS. Data at rest is encrypted. Our two database servers, one for spawnpoint's own records and one for your apps' databases, store their data encrypted with keys managed by Amazon Web Services. Every file storage bucket is encrypted with AES-256, and so is the disk of the server that runs spawnpoint. The environment variables you set are encrypted a second time, with AES-256-GCM, before we store them.

Backups

Both database servers keep automatic backups for 7 days and can be restored to any moment in those 7 days. Both have deletion protection, and a final snapshot is taken if one is ever deleted. spawnpoint's own database is also copied every day and before every update to spawnpoint, and each copy is kept for 30 days. These backups exist to recover the whole service. There is not yet a way to restore one app's database on its own. The folder on an app's machine where the app can keep files is not backed up.

Network

spawnpoint's own database accepts no connections from the internet: only the spawnpoint server can reach it. Your apps' databases accept only encrypted connections, and each one has its own user and password, so one app's password cannot open another app's database. The server that holds your apps' databases accepts no connections from the internet either: only your apps' machines and the spawnpoint server can reach it. To look at an app's data, open its database on the app's page in the console, or ask your agent.

Who can reach your data

Only our founder can reach the machines, databases, and files that run your apps. We look at an app's data only when its owner asks for help, or to stop abuse. The providers listed in our privacy policy operate the infrastructure underneath.

Where your data lives

spawnpoint's own systems run on Amazon Web Services in the United States, in the us-west-2 region (Oregon): the spawnpoint server, both database servers, file storage, and backups. The machines your apps run on are there too, in the same region. Changes to our Amazon Web Services resources in that region are recorded in an audit log that we keep for a year. Requests an app sends to open models go to Amazon Bedrock in the same region, which runs those models with zero data retention set on our account: Amazon Web Services keeps no requests or answers, does not use them to train models, and does not share them with the companies that make the models. Embeddings, which an app uses to search its own text, go there too, under the same terms. The privacy policy lists every provider and what each one receives.

A team admin chooses which open models the team's apps can call through spawnpoint. Calls to any other model are refused, and every call is recorded with the model that answered it. The approved-models list applies to calls through spawnpoint's model endpoint. An app that uses its own provider key calls that provider directly, and spawnpoint does not see or limit those calls.

Agents

An agent you connect signs in through your browser and gets an access token that lasts an hour. It renews that token for up to 90 days, then has to sign in again. Deleting a project, its database, or its file storage needs an explicit confirmation from the agent, and spawnpoint's instructions tell the agent to ask you first. You can disconnect an agent from the console at any time.

When you approve an agent, or make an API token, you can choose read only. A read-only agent can look at your projects, their logs and visits, and their databases, and it cannot deploy, change, share, or delete anything.

Uptime

On paid plans we aim for 99.5% uptime each month, with service credits when we miss it. The terms give the details. The status page shows the current state of the console, sign-in, billing, and app machines.

Teardown

Terminate is one click. The project's machine or stored files are deleted and the URL is freed right away, so nothing keeps running or adds to your bill.

Your data

We keep your account email; your projects' settings and history; the environment variables you set, encrypted; hashes of your tokens; your plan; the email addresses you share projects with and when they opened them; your custom domains; request logs; and when each app was last visited. The files you deploy live on your project's machine (or in our storage, for a static project), and we hold an upload for at most 30 minutes. A project's database and file storage hold whatever your app puts in them, and are deleted with the project (a database is kept 7 days first, so its owner can restore it). Card details stay with Stripe. The privacy policy lists all of it, with how long we keep each.

Audits

Everything spawnpoint runs on is hosted by Amazon Web Services: the spawnpoint server, both database servers, file storage, backups, and the machines your apps run on. Each Amazon Web Services service we use (EC2 and its disks, RDS, S3, SES, KMS, VPC, IAM, CloudTrail, Systems Manager, and EC2 Image Builder) is in scope of their SOC 1, SOC 2, and SOC 3 reports. Those reports cover their part: the data centers, hardware, network, and the services themselves. Their SOC 3 report is public. spawnpoint's own software and how we run it have not yet had a third-party audit of their own, such as SOC 2. Our data processing agreement is published, and we countersign a copy on request. If your company needs a security questionnaire answered, email support@getspawnpoint.com and we will answer it.

Reporting an issue

To report a security issue, email support@getspawnpoint.com. We will respond quickly.