Skip to main content
SpearPoint LogoSpearPoint

Security & Data Protection

How SpearPoint hosts, protects and handles your organization’s data. Everything on this page describes how the service works today.

Request a DPAView sub-processors

Last updated October 22, 2026

Hosted on Google Cloud in the US

The application runs on Google Cloud and Firebase. Our databases are in the United States: Cloud SQL in us-central1 (Iowa) and Cloud Firestore in the nam5 US multi-region.

Encrypted in transit and at rest

All traffic is served over HTTPS with HSTS. Google Cloud encrypts stored data at rest by default.

Role-based team permissions

Organizations have owner, admin, editor and viewer roles, with per-member permissions for members, billing, CRM, campaigns and settings.

Daily backups

Our primary PostgreSQL database has automated daily backups kept for 7 days, plus point-in-time recovery.

Payments through Stripe

Checkout and billing happen inside SpearPoint, but card details are typed into secure Stripe fields (Stripe Elements iframes) and go directly to Stripe. SpearPoint never receives or stores full card numbers.

Export and deletion

Users can download their account data and delete their account themselves. Deleted profiles are purged after a 30-day grace period.

Infrastructure and data location

  • SpearPoint runs on Google Cloud through Firebase App Hosting, Cloud Run and Cloud Functions.
  • Customer data is stored in Cloud SQL for PostgreSQL (us-central1) and Cloud Firestore (nam5, a US multi-region). Firebase Authentication and Google Secret Manager are global services operated by Google.
  • Application secrets such as payment and database credentials are kept in Google Secret Manager, not in source code.
  • Google Cloud encrypts data at rest by default. Traffic to spearpointdata.com is HTTPS only, with an HTTP Strict Transport Security header.

Authentication and sessions

  • Sign-in uses Firebase Authentication with email and password. Passwords are handled by Firebase and never stored by SpearPoint.
  • Browser sessions use a server-verified token in an HttpOnly, Secure, SameSite=Lax cookie that page scripts cannot read.
  • When an account is deleted, its sessions are revoked and sign-in is disabled immediately.

Access control

  • Every request for paid data is checked on the server against the states and plan your organization subscribes to. The AI assistant applies the same per-state checks.
  • An automated test runs with our test suite and fails if any server action lacks an authentication or entitlement check. A short, reviewed list of public endpoints (such as the pricing catalogue) is exempt.
  • Organization roles (owner, admin, editor, viewer) set default permissions, which owners can adjust per member. Changes to membership and roles are checked on the server.
  • SpearPoint staff tools require an administrator role that is verified on the server.

No public API

  • SpearPoint does not offer a public API or API keys. Our server endpoints exist only to serve the SpearPoint website and app.
  • Endpoints that return customer or subscription data require a signed-in session. The few endpoints the website needs before sign-in (such as pricing, contact forms, unsubscribe links and status checks) are rate-limited or require a signed link, return no subscription data and do not allow cross-origin browser access.

Audit logging

  • We record security-relevant events in an audit log: sign-ups, sign-ins and failed sign-ins, organization membership and role changes, administrative actions, terms acceptance, and data export and deletion requests.
  • Audit records are written by the server and cannot be changed or deleted from the browser.

Your data, your control

  • Any user can download a JSON copy of their account data from the Data & Privacy section of their profile settings.
  • Account deletion is self-service. It cancels active subscriptions at the end of the billing period and immediately revokes sessions and removes alert rules. After a 30-day grace period, the user profile with its follows and settings, profile photos and the Stripe customer record are permanently deleted.
  • Records a user created inside a shared organization workspace, such as CRM entries and comments, belong to the organization and are not removed by account deletion. Contact us to have them deleted.
  • Optional Gmail and Microsoft 365 connections request send-only permission. Their access tokens are stored in Google Secret Manager.

AI features

  • AI summaries, briefings and reports use the Google Gemini API.
  • We send only what a request needs: the text you enter and the legislative records used to answer it. Gemini processes this data under Google’s API terms.

Sub-processors

We use a small number of service providers to run SpearPoint: Google (Cloud, Firebase, Gemini API, Maps Platform), Stripe for payments, Microsoft 365 for email delivery, and Twilio for optional text-message alerts.

Full sub-processor list

Data Processing Addendum

Customers can sign our Data Processing Addendum. It covers confidentiality, security measures, sub-processor notice, breach notification, help with data-subject requests, and deletion or return of data at the end of your subscription.

Request a DPA

Compliance status

  • SOC 2: not yet. We have not completed a SOC 2 or ISO 27001 audit.
  • Security questionnaires: available on request. We will complete your firm’s questionnaire.
  • Multi-factor authentication and single sign-on (SAML/OIDC): not yet available.
Send us a questionnaire

Responsible disclosure

If you think you have found a security vulnerability in SpearPoint, email security@spearpointdata.com with steps to reproduce. Please give us reasonable time to fix the issue before disclosing it, and do not access other customers’ data, degrade the service, or run automated scans at high volume.