Security and access control
Roles defined per workspace, identity-provider login, and data isolated per tenant.
Role-based access
Each person receives a role inside the workspace, and what they can see or do follows that role.
- Owner, admin, member, and billing admin
- Invites and revocations controlled by the workspace
- Platform owner kept separate from tenant roles
Authentication
Login uses Authorization Code with PKCE against an identity provider. The browser session lives in an encrypted, HTTP-only cookie.
- OIDC flow with PKCE
- Issuer, audience, and nonce validation
- Encrypted, HTTP-only session
Workspace isolation
Every product request carries the active tenant, and the API resolves the person's membership in that tenant before responding.
- Records linked to a tenant
- Membership checked on every request
- No access across workspaces
Traceability
Changes to catalog, tenant commercial state, and billing produce an audit record.
- Audit trail for operations
- Audit access restricted to the platform owner
- History kept as business record
Secrets and retention
Payment provider secrets are stored encrypted, and the retention routine targets operational tables, not the audit trail.
- Encrypted secrets, not public JSON
- Retention routine for operational tables
- Audit trail preserved
Questions
Does Spotren have SOC 2 or ISO 27001 certification?
No. No certification is published today.
Is data backed up?
Operations keeps documented backup and restore procedures.
Who can read the audit trail?
Audit access is restricted to the platform owner.
Review security with the team
Open the app to see the product or use the contact channel for specific requirements.
Open the app