Sparkforge Security and Compliance Overview

This document covers how Sparkforge protects the data you put into the platform — infrastructure, application security, customer data handling, identity controls, organizational practices, compliance, and privacy.

Infrastructure security

Hosting

Sparkforge does not host product systems or data in its physical offices. Production runs on Google Cloud Platform and Amazon Web Services in the United States. Both providers carry SOC 2 Type 2 reports and ISO 27001 certifications. Google publishes at least 99.5% monthly uptime; AWS targets 99.95–100% with redundant power, network, and HVAC.

Network and perimeter

Multiple layers of filtering and inspection sit in front of the application — web application firewalls, security groups, and network ACLs. Default-deny is the rule: nothing is reachable unless it is explicitly authorized. Firewall rulesets are reviewed on a regular cadence.

Configuration management

Server configurations live in images and config files baked into the deployment pipeline. Containers are provisioned from a hardened baseline. If a production server drifts from baseline, it is overwritten within 30 minutes. Patching is automated.

Logging, alerting, and monitoring

Application and security events are logged centrally. Engineers and admins are alerted on error rates, abuse patterns, application attacks, and other anomalies. Automated triggers throttle traffic, terminate processes, and respond to threshold breaches without waiting on a human.

Application security

Web application defenses

All hosted content sits behind WAF and DDoS protections. Detection rules align with OWASP Top 10 guidance. The monitoring layer flags malicious behavior by type and session rate.

Development and release

New code goes through code review, static analysis, and automated tests before being merged. Builds run in CI, deploy to a separate QA environment, and then promote to production. Releases are continuous and seamless — there is no scheduled downtime for product updates. Deploys can be reverted automatically on failure.

Vulnerability management

Vulnerability scans run on a regular schedule using current detection signatures. Annual penetration tests cover both applications and infrastructure. Findings are triaged and mitigations prioritized by severity.

Customer data protection

Data classification

Per the Terms of Service, Sparkforge customers are responsible for only collecting data appropriate for their use case. The product should not be used to store credit card numbers, SSNs, passport numbers, or financial/health information except where explicitly permitted.

Tenant separation

Sparkforge is multi-tenant. Customer data is logically separated by unique tenant IDs, with authorization rules validated continuously. Authentication, access changes, and availability events are logged.

Encryption

Data in transit uses TLS 1.2 or 1.3 with 2,048-bit keys or stronger. Data at rest uses AES-256. User passwords are hashed using current industry practices and encrypted at rest.

Key management

TLS keys are managed by the content delivery partner. Volume- and field-level encryption keys live in a hardened KMS. Key rotation cadence varies by sensitivity; TLS certificates are renewed annually. Customer-supplied encryption keys are not supported at this time.

Backup and disaster recovery

Infrastructure is distributed across multiple availability zones with point-in-time recovery for web, application, and database tiers. Databases are backed up on schedule, with seven days of backups retained. Backup jobs are monitored; failures alert and escalate.

Sparkforge does not use physical storage media — all backup and recovery happens inside cloud providers. Backups are protected with WORM controls and ACLs.

Restoring data

Customers cannot trigger their own failover, but the in-app recycle bin lets you recover deleted contacts, opportunities, custom fields, custom values, tags, notes, and tasks for up to 30 days. Web pages, blog posts, and emails can be rolled back through version history. For your own backups, every major area supports CSV export and the public API can sync data to outside systems.

Identity and access control

Customer-side

Sparkforge supports granular role-based authorization. Account admins create users, assign privileges, and limit access. The native login enforces an 8-character minimum with mixed case, numbers, and special characters. Two-factor authentication is available, and admins can require it for all users.

Sparkforge employee access

Production access is restricted using role-based access control. Day-to-day access is limited to engineering, with persistent admin access tightly scoped. Direct SSH to production is prohibited — engineers go through a bastion host or assigned IAM role.

Support and customer-engagement staff use a Just-in-Time Access (JITA) model to view a customer portal for up to 24 hours, with each request logged. JITA blocks high-risk actions including changing domain or SSO settings, exporting users or contacts, viewing or rotating private app keys, importing data, and deleting CRM records.

Corporate

Network access requires MFA. Password policies cover length, complexity, and rotation. Vaults manage administrative credentials behind RBAC and JITA. Access reviews are run at least every six months.

Organizational and corporate security

Employees pass third-party background checks before hire and acknowledge the Employee Handbook and Code of Conduct. Written policies — including a core Information Security Policy — are reviewed annually. CyberSafety and phishing-awareness training is required at hire and refreshed annually. Vendors are vetted for security and privacy controls; sub-processors are listed in the Data Processing Agreement. Company laptops are centrally managed with full-disk encryption and MDM.

Compliance and privacy

Sparkforge does not store, process, or collect credit card data and is not PCI-DSS compliant — payment processors handle that. We do not sell personal data. Customer data is retained while you remain an active customer; deletion requests are honored as required by privacy regulations. Some logs and metadata are retained for security, compliance, or statutory needs. Custom retention policies are not currently configurable by customers.

GDPR and breach response

Sparkforge provides features to help customers meet GDPR obligations — see the GDPR resources in the help center. Using Sparkforge alone does not make you GDPR compliant. If a data breach affects your personal data, Sparkforge will notify customers as required by law.

Document scope

This document is informational. It does not create or amend any contractual obligation. Controls evolve over time. Questions go to legal@sparkforge.com.