Security is foundational to PadSpec. Engineering firms trust the platform with their design inputs and their most valuable intellectual property — the rule overlays that encode their engineering practice. This page summarizes how we protect that data. It describes our current posture and is not a warranty; specific commitments are governed by your agreement with PadSpec LLC.
Tenant Isolation
PadSpecis multi-tenant by design. Every data access is scoped to an organization through a single tenant-aware data layer, so one customer's projects, specifications, and rule overlays are never visible to another. Isolation is enforced in code at the boundary rather than left to individual queries.
Encryption
Data is encrypted in transit using TLS. Data at rest is encrypted using our cloud infrastructure providers' managed encryption. Secrets and credentials are held in managed secret storage, never in source control.
Authentication and Access Control
User authentication is handled by a dedicated identity provider, supporting modern practices such as multi-factor authentication and single sign-on where configured. Within an organization, access to projects and rule authoring is governed by roles and least-privilege permissions. Server-side authorization is enforced on every request; the client is never trusted to make access decisions.
Auditability and Data Integrity
Generated specifications, rule snapshots, and audit events are stored as immutable versions — new states are written as new records rather than overwriting prior ones. This preserves a complete, tamper-evident history of how every facility specification was produced and which rules drove each decision.
Infrastructure
The Service runs on established cloud platforms with managed networking, automated patching, backups, and monitoring. We follow a least-privilege model for internal access to production systems and maintain logging to support monitoring and incident response.
Development Practices
Changes go through version control, automated typechecking, linting, and tests as deploy gates, with per-change preview environments. Dependencies are monitored for known vulnerabilities.
Compliance
We build to widely recognized security principles, including those underlying SOC 2, and are maturing our controls and documentation as the product grows. We do not currently claim any formal certification; we're happy to discuss our current posture and roadmap with prospective customers under NDA.
Responsible Disclosure
If you believe you have found a security vulnerability, please contact us at security@padspec.com. We appreciate responsible disclosure and will work with you to investigate and resolve valid reports. Please give us a reasonable opportunity to remediate before any public disclosure.