Built as if your client files depend on it. They do.

Isolation and keys

• Your company gets its own environment, with its own database and its own storage, never shared with another company. Its requests are routed to it alone, and it checks that each one is its own.

  In place

• Your content is encrypted under a key that belongs to your company’s environment, and its database backups are encrypted with it.

  In place

• Every request is tied to your company by its verified sign-in, never by anything the request claims, and every read is limited to your company’s records.

  In place

• Your company’s database enforces the same limit on every one of its tables, and the service that uses it can neither get around the limit nor alter the tables.

  In place

Where data goes

• Your content is stored and processed in Canadian regions, the model engine included. There is no fallback route outside Canada: if a Canadian route is not available, the request stops.

  In place

• Logs carry diagnostics, never your content, and are kept for thirty days.

  In place

• Uploads are held in a private quarantine and reach your company’s storage only after the exact file is checked. Each file is parsed for its text and structure alone, in an isolated process, and nothing in it is ever run.

  In place

Codes and standards are your own licensed copies, read inside your environment under your authorization, never pooled.

Every third party that processes customer data is listed, with its purpose, the data it handles and its region, on the subprocessors page.

The model routes’ verification

• Before any content reaches the model, its route is checked for the model, a Canadian region, and current no-training and zero-retention evidence. A route without that evidence is refused, never downgraded.

  In place

• The model sees one page or one group of drawing facts at a time, and is reached without any stored key. It has no tools, search, code execution or caching.

  In place

• The model’s output is data, never an instruction: it becomes a proposal only after it passes validation, and text inside a drawing or a markup is never treated as a command.

  In place

• Nothing changes in a drawing until an engineer accepts the proposal, and the acceptance is bound to the exact version that was checked.

  In place

Who can see what

• SparkFlow’s operator sees counts, never content: there is no standing access to your drawings, markups or standards.

  In place

• Support reads your audit records only under a grant your IT administrator approves, for one case and a set time, and an extended grant needs a second administrator. The grant expires on its own, and every read is recorded.

  In place

• Members sign in through your company’s own sign-in tenant. Every request’s sign-in is verified, and a suspended member’s next request is refused.

  In place

• Roles separate IT administration from drawing work, and the last administrator can never be removed.

  In place

The audit ledger

• Every proposal, decision and teaching, and every administrative act, is written to an append-only ledger in your environment as it happens: who, what, when and the result. Content is never in the ledger, only references.

  In place

• Your IT dashboard searches your company’s ledger, and your administrators can export your company’s records; every export is itself recorded.

  In place

• Alerts watch the service for unusual activity.

  In place

Offboarding

• When you leave, access is revoked, work stops, queued jobs are cancelled, and your environment is wiped, with a proof of the wipe.

  In place

• A company that has left is never routed to again.

  In place

Reporting a concern

If you think you have found a security problem in SparkFlow, write to mohsin.tunio@sparkflowai.ca, or reach us through the help desk. Say what you saw and when, and never include a drawing, a password or other credential, or client information.