Trust and service levels for ClearScreen

The customer database is stored in the region chosen at purchase, under Spot Cloud B.V., registered in the Netherlands. Trials run in the EU (Paris). A paid workspace runs in Frankfurt for the EU or Middle East & Africa, or in London, N. Virginia, Montréal, Singapore or São Paulo. Whatever region was chosen, shared bundle files (R2) and our hourly backup dump of the database sit in Cloudflare object storage in Western Europe under Cloudflare’s default jurisdiction, not pinned to an EU jurisdiction.

Posture is GDPR · DORA · NIS2. Control mapping and audit evidence are shared under NDA.

Spot Suite OIDC with Microsoft Entra ID, Okta, or any OIDC provider, with sign-in policy set by your identity provider. Spot Suite does not itself enforce MFA; each user can add a passkey or authenticator app. SAML and SCIM provisioning are on the enterprise roadmap, prioritized with design partners.

Report security issues to hello@spot-suite.com. Reports are acknowledged within two business days and disclosure is coordinated with the reporter. A machine-readable policy lives at /.well-known/security.txt.

SIG- and CAIQ-style vendor questionnaire answers, the DPA, and control mapping are available on request, with a typical turnaround of two business days.

Trials and shared data live in the shared EU Supabase Postgres project (Paris); a paid workspace has its own Supabase project in the region chosen at purchase. Supabase backs up each project once a day and keeps each backup for seven days, with no point-in-time restore; Supabase and Cloudflare both encrypt stored data by default. We also run our own hourly dump of that data into Cloudflare object storage in Western Europe. There is no failover to a second region, no restore drill has run yet, and restoring is a manual process, so we publish no recovery time or recovery point target. If every hourly dump succeeds and can be restored, an incident would lose roughly the last hour of data; that is an untested estimate, not a guarantee.