Security
How SpecProven handles project data
This page describes the current hosted app. It is not a SOC 2 report, a DPA, or a claim about a future architecture.
Where records live
Accounts, projects, specification text, inspection lines, reports, and membership live in a Supabase Postgres database. PDF files are stored in a private Supabase Storage bucket named documents. The Next.js app on Vercel does not keep project files on the server disk after a request finishes.
Access
People sign in with email and password through Supabase Auth. Each project has members with a viewer, editor, or admin role. Row-level security on project tables limits reads and writes to members of that project. Inspectors who receive an email request can approve or deny from a tokenized link without creating an account. That link is a secret; anyone who has it can respond until it expires.
What leaves SpecProven
Specification pages and extracted lines are sent to an AI model provider (OpenAI-compatible API, e.g. via OpenRouter), only when configured. If that provider is not configured, extraction stays on the built-in parser and scanned pages stay unread. Inspector invitations and other app mail are sent only when SMTP or Resend is configured. Signup and password-reset mail is sent by Supabase Auth, using Supabase's mailer or a custom SMTP server configured in the Supabase project.
Retention
Project records and PDFs remain until a member deletes them or the project is removed. SpecProven does not currently run an automatic purge after a number of days. Versioned specifications keep earlier issues so a team can compare and restore them.
What this page does not claim
SpecProven does not claim a completed SOC 2, ISO 27001, or similar audit. It does not offer a customer-managed encryption key. Live connections into Procore or Autodesk Construction Cloud are not in this version; the handoff is a CSV or Excel file those products can import.