Encryption
Customer data is encrypted in transit with TLS 1.2 or later and at rest with AES-256 encryption.
Security & compliance · Built for high-stakes projects
Security that shows its work.
Your project record can contain pricing, protected facility details, and the decisions that govern the work. Specset protects that record from upload through inference, and publishes the evidence procurement teams need to verify it.
Assurance file · SCP-01
Current public posture
PublishedSpecset Cloud Platform
- SOC 2 Type II
- Independent attestation
- CMMC Level 1
- Self-attested
- FedRAMP Class A
- Class C in progress
- Access controls
- MFA · RBAC
- Model training
- Customer data excluded
SOC 2 Type IIIndependently audited
CMMC L1Self-attested
FedRAMP Class AClass C in progress
01 · Data flow
Know where the record goes.
Specset narrows every step to the data needed for the job. Files remain part of your protected project record. Model providers receive scoped context for inference, not a corpus to train on.
01Project documentsSpecs · Drawings · Submittals · RFIs
TLS 1.2+
Specset security boundary
02Encrypted project recordAES-256 at rest · RBAC · Access logging
Relevant context only
03Approved model inferenceCustomer content excluded from training
Cited result
04Answer in the recordSource-linked · Reviewable · Auditable
02 · Controls
Controls that survive the questionnaire.
The answers procurement asks for most are not promises on a sales slide. They are operating controls, independently examined and supported by evidence.
Identity & access
Multi-factor authentication, role-based access control, least-privilege practices, and access logging govern production access.
Operations
Change management, incident response, vendor security review, and control monitoring sit inside the audited security program.
Data ownership
You retain ownership of uploaded documents and project data. Specset uses them only to operate and improve the service.
Data lifecycle
Project data is retained only as needed to provide the service and meet legal obligations. Deletion requests go directly to our team.
Independent evidence
Detailed security documentation and assurance reports are available through the Specset Trust Center, with protected reports available by request.
03 · AI & your data
Your project is context, never training material.
Specset uses approved large-language-model APIs to analyze project documents. We send the context needed to perform the requested work. Your content is not used to train third-party models.
You keep ownership of uploaded content. Our use is limited to operating and improving the service, subject to the agreements and controls that govern your account.
Read the AI data policy →Inference contractPer request
- 01Scope
Retrieve the relevant project context for the requested task.
- 02Protect
Transmit over encrypted channels to an approved provider.
- 03Answer
Return the result with project citations for human verification.
- 04Exclude
Do not use customer content to train the provider's models.
04 · Government deployment
A separate lane for controlled work.
SpecGov is a separate government instance for projects with controlled-data requirements. Model inference is pinned to the defined boundary with no fallback outside it. Analytics and public-site widgets stay out.
Security requirements vary by agency, contract, and data type. Our security team will map the deployment and evidence to your specific requirements before data is introduced.
Review your requirements →SpecGov · boundary viewRestricted
U.S. government deployment
Defined security boundary
SpecGovProject record · Agents · Model inference
Unapproved third-party egressBlocked
05 · FedRAMP
The listing is public. The status is precise.
Specset Cloud Platform is listed in the official FedRAMP Marketplace at Class A, with Class C certification in progress.
Official marketplace recordClass A
- Cloud service offering
- Specset Cloud Platform
- Marketplace ID
- FR2631258135
- Current class
- FedRAMP Class A
- Next milestone
- Class C in progress
- Authorizations
- 0 · Not yet certified
06 · Evidence
Start the review with the source documents.
Public posture, protected reports, legal terms, and a direct line to the people who own the controls.
01 · Assurance
Trust Center
Security posture, control monitoring, and protected reports available by request.
Open Trust Center →02 · FederalFedRAMP record
Independent program listing, current phase, deployment model, and public contacts.
Verify the listing →03 · LegalPrivacy & terms
How information is collected, used, protected, retained, and governed.
Read the policies →Bring the questionnaire
Let security talk to security.
Send your data-flow questions, control matrix, or agency requirements directly to the team that owns the answers.