Security
Billing data handled like production infrastructure.
Read-only collectors, per-customer isolation, US residency under Spot Cloud B.V., and Spot Suite identity on every tier.
-
Spot Suite OIDC SSO
Single sign-on via Spot Suite OIDC with Microsoft Entra. Business adds SAML and OIDC federation.
-
Dedicated per-customer isolation
Each customer gets their own Worker, D1 database, and storage. No shared tenancy for billing or attribution data.
-
Tenant-scoped data
Cost records, attribution rules, and audit events are scoped to your tenant. Cross-tenant access is not possible at the application layer.
-
US data residency
Billing data is processed and stored in US jurisdiction on Cloudflare Workers, D1, and R2 under Spot Cloud B.V. Deleted within 30 days of contract end.
-
Audit logging
Sign-in events, configuration changes, and export actions are recorded for review on the Business tier.
-
Control mapping: HIPAA · NIST CSF 2.0 · CIS Controls v8
Platform controls are mapped to HIPAA, NIST CSF 2.0, and CIS Controls v8 for billing data handling. Audit evidence is shared under NDA — formal SOC 2 or ISO certifications are not claimed.
-
Read-only cloud access
Collectors use AWS IAM role, Azure service principal, GCP service account, or StackIT project token. Read-only by default; optional lifecycle write scopes are opt-in per cloud.
-
Passkeys and MFA
All tiers require passkeys or authenticator-app MFA through Spot Suite identity. No password-only access.
Questions about our posture?
Book a 30-minute walkthrough of isolation, data handling, and cloud access scopes.