Your data stays yours.
Independently tested. Strictly isolated.
How SpendCraft protects your spend data, from connection to deletion.
SOC 2
Independently audited security controls.
Pen Tested
Penetration tested by an independent third party. Summary available under NDA.
NIST AI RMF
AI risk managed in line with the NIST AI Risk Management Framework.
How We Protect Your Data
From connection to deletion.
Workspace Isolation
Each customer workspace is strictly isolated. Data you upload stays your property, and SpendCraft acts only as its processor.
Encryption
Data is encrypted in transit and at rest.
Hosting
Hosted on Microsoft Azure, which maintains SOC 2 Type II, ISO 27001 and other industry certifications. Data transfers use recognized safeguards such as Standard Contractual Clauses.
Access Control
Role-based permissions, multi-factor authentication for administrative access, and continuous monitoring.
Connections
500+ prebuilt connectors, plus secure file upload. Minimal day-to-day IT involvement.
Your Controls
Your Activity shows what SpendCraft knows about your scope, with controls to clear, pause, reset or export.
Retention and Deletion
Data is kept only as long as needed to provide the service and meet legal requirements. Request deletion anytime at privacy@spendcraft.com.
Subprocessors
Trusted providers for cloud hosting, authentication, billing and data connections, all contractually bound to strict confidentiality and security standards.
Responsible Disclosure
Found a vulnerability or something suspicious? Tell us at info@spendcraft.com.
Running a security review?
We’ll share our penetration test summary under NDA and answer your security questionnaire.