Security and data handling

How Spavik controls access, protects the data your application sends and lets you delete it.

Access control

One key, one workspace: Each API key opens a single workspace and cannot reach the models of another workspace or account.
Two kinds of keys: Usage keys (sk-spv-api-) create models and request predictions. Admin keys (sk-spv-admin-) manage keys, webhooks and billing settings and cannot request predictions.
Shown once, stored as a hash: The full key is displayed once, when it is created. Spavik only stores a hash of it.
Rotation and revocation: Replace a key with a grace period so your application keeps running, or revoke it at once if it may have been exposed.
Billing needs a person: Subscribing, changing plan, cancelling and buying credits require a signed-in user. API keys cannot perform these actions.

Encrypted in transit: The API, the MCP server and the platform are served over HTTPS only.
Encrypted at rest: Archived inputs, outputs and submitted outcomes are encrypted with AES-256-GCM, using a key for each model that is itself protected by a master key.
What a model keeps: A model keeps prepared examples from your data as context, for each version. Forecasts create no model, and Spavik keeps no history of your predictions that can be queried.
No third-party AI: Predictions are computed by Spavik’s own engine. Your data is not sent to other AI providers.

Archive or delete: Archiving keeps a model with its versions and outcomes, and frees a slot in your plan. Deleting it purges it from the engine with its pending outcomes, and cannot be undone.
Data policies by plan: On Build, your data is not reused for training. Pro and Growth add zero data retention for the inputs and outputs of predictions, forecasts, evaluations and backtests. Enterprise terms are negotiated.
Retention periods: Request logs are kept for 90 days, archived inputs and outputs for up to 12 months, and the idempotency cache for 24 hours. The privacy policy lists every period.

Request logs: Every call returns a request_id. You can review your workspace’s calls from the last 30 days, with their status, error code and the key used.
Readable errors: Each error carries a stable code and a detail that says what was refused and how to fix it.
Safe retries: On automatic retries, the SDKs send the same idempotency key, so a retried request is not charged twice within 24 hours.

Google Cloud: Spavik runs on Google Cloud. Hosting regions and technical providers are listed in the privacy policy.
Payments: Card payments are handled by Stripe. Spavik does not store card numbers.

Write to us to report a vulnerability, ask a security question or request a data processing agreement.