Your data stays yours.
Independently tested. Strictly isolated.
How SpendCraft protects your spend data, from connection to deletion.
SOC 2 Type II
Independently audited security controls.
Pen Tested
Penetration tested by an independent third party. Summary available under NDA.
NIST AI RMF
AI risk managed in line with the NIST AI Risk Management Framework.
How We Protect Your Data
From connection to deletion.
Workspace Isolation
Each customer workspace is strictly isolated. Data you upload stays your property, and SpendCraft acts only as its processor.
Encryption
Data is encrypted in transit and at rest.
Hosting
Hosted on Microsoft Azure, which maintains SOC 2 Type II, ISO 27001 and other industry certifications. Data transfers use recognized safeguards such as Standard Contractual Clauses.
Single Sign On
SSO with your existing identity provider is included on every plan, not sold as an add on.
AI and Your Numbers
Deterministic code produces every number. Proprietary AI reads, narrates and suggests, and never generates a figure.
No Cross Customer Data
No cross customer data and no cross customer benchmarking. Each customer's data is isolated by design.
Access Control
Role-based permissions, multi-factor authentication for administrative access, and continuous monitoring.
Connections
500+ prebuilt connectors, plus secure file upload. Minimal day-to-day IT involvement.
Your Controls
Your Activity shows what SpendCraft knows about your scope, with controls to clear, pause, reset or export.
Retention and Deletion
Data is kept only as long as needed to provide the service and meet legal requirements. Request deletion anytime at privacy@spendcraft.com.
Subprocessors
Trusted providers for cloud hosting, authentication, billing and data connections, all contractually bound to strict confidentiality and security standards.
Responsible Disclosure
Found a vulnerability or something suspicious? Tell us at info@spendcraft.com.
Questions IT Asks
The security review, answered in advance.
What data does SpendCraft need?
Supplier invoices, purchase orders, line items and vendor details. Not engineering, sales or employee records. Ask us for the extract template before the first call, so your team can scope the connection to those fields.
Whose data sits next to ours?
No one's. Each customer workspace is strictly isolated, with no cross customer data and no cross customer benchmarking.
Where is the AI, and does it touch the numbers?
Proprietary AI classifies, narrates and drafts suggestions, each citing the metric behind it. Deterministic logic produces every number, including every savings range. See how the AI works.
What independent evidence can you show?
A SOC 2 Type II report, and a summary of our annual third party penetration test under NDA. Our AI risk management aligns with the NIST AI Risk Management Framework.
How does it connect?
Through prebuilt connectors or secure file upload. Many teams start a Proof of Value on a single file extract and connect live systems later, with minimal day-to-day IT involvement.
How do our people sign in?
Single sign on with your existing identity provider, included on every plan.
What happens to our data if we leave?
Your data stays your property. Request deletion at any time at privacy@spendcraft.com.
Running a security review?
We’ll share our penetration test summary under NDA and answer your security questionnaire.
Related reading: The IT review your spend tool has to pass