Skip to content
Legal

Security

Last updated: August 4, 2026

Measures we operate, checked against the backend. Spooled Cloud is operated by YS Progress Inc. (Ontario, Canada). Contact: security@spooled.cloud.

Job payloads are stored as plaintext

Job payload is JSONB in PostgreSQL with no application-level encryption. Do not put secrets in payloads — store them in a vault and pass a reference.

1. Data flow

Spooled Cloud data flow Your app connects over TLS 1.3 to Cloudflare, then to the Rust API, which writes to Postgres and Redis with organization-scoped queries. Your app SDK / HTTP Cloudflare TLS 1.3 · Tunnel Rust API REST · gRPC · WS PostgreSQL Redis WHERE organization_id = $auth_org application-layer isolation (not RLS)
  • Edge TLS via Cloudflare Tunnel (prod compose). Default Compose Postgres URLs omit sslmode.
  • Isolation: handlers use WHERE organization_id = …. RLS policies exist in migrations but are not activated per request.

2. Authentication & API keys

  1. 01 · Create

    Mint key

    sp_live_ / sp_test_

  2. 02 · Shown once

    One-time display

    Full secret only in create response

  3. 03 · Hash stored

    bcrypt + lookup

    cost 12 + SHA-256 lookup_hash

  4. 04 · Revoke

    Soft-disable

    is_active=false; cache cleared if Redis up

  • Prefixes issued: sp_live_, sp_test_. Legacy sk_ still accepted.
  • Raw keys never stored. Queue-scoped keys cannot mint broader keys.
  • JWT access default 24h (JWT_EXPIRATION_HOURS); refresh 24× that (default 576h).
  • Auth cache TTL 60s. Revoke invalidates cache when Redis is available; otherwise a revoked key may work until TTL expires.

3. Webhooks

  • HMAC-SHA256 (X-Spooled-Signature over timestamp.payload) only when a webhook secret is set. Unsigned delivery is allowed without one.
  • SSRF blocks for private/metadata hosts; HTTPS required for targets in production.

4. Application controls

  • Rust backend; cargo audit in CI.
  • Service config and secrets loaded from the environment at runtime.

5. Compliance status

Control Status
SOC 2 Not held
ISO 27001 Not held
TLS at edge (Cloudflare) Operated
Org-scoped queries In code
API key hashing (bcrypt 12) In code
Job payload encryption at rest Not applied
Postgres RLS (active) Not active

We answer reasonable security questionnaires for serious evaluations. No implied certification roadmap.

6. Disclosure & incidents

  • Report vulns to security@spooled.cloud with repro steps. Ack target: three business days. Good-faith research is welcome; credit on request.
  • Incidents: notify as required by law/contract; share a summary with impacted customers when appropriate; track fixes to closure.
  • Procurement reviews: same inbox — we share what is currently available.