Spanwise

Security

Our actual posture, stated plainly. SaaS-appropriate, no theater.

  • Every API endpoint except /health requires a per-workspace API key sent in the x-spanwise-key header.
  • Workspace keys are random 128-bit values; the key identifies the workspace and there is no cross-workspace access path.
  • The audit log is a SHA-256 hash chain — tampering with any entry is detectable via /v1/audit/verify.
  • Self-hosted deployments keep all trace data on your infrastructure; SQLite by default, Postgres for production.
  • Structured logs never include API keys or trace payload contents.
  • Report a vulnerability: email us and we'll respond within 2 business days.
What we don't claim: we don't claim certifications we don't hold, we don't claim "military-grade" anything, and we don't claim a system can't fail — we claim the specific controls above and a 2-business-day response on reports.