Security
Spendline, Inc. · Last updated: October 28, 2026
Spendline sits in the critical path of your production AI API traffic. Security is not a checkbox. It is a core product requirement. This page describes how we protect your data and requests.
TLS everywhere
All traffic between your application and Spendline is encrypted via TLS 1.2+. We do not accept unencrypted connections.
Encrypted at rest
Provider API keys are encrypted by Spendline with AES-256-GCM before they are stored. Our managed database provider also encrypts the storage it runs on.
Hashed credentials
Passwords and Spendline API keys are stored only as hashes (bcrypt). We cannot recover a Spendline key once issued. Provider keys are different: they are encrypted, not hashed, because the proxy must use them.
No prompt logging
Spendline stores call metadata and one-way fingerprints, and does not log prompt or completion text. For failed calls it keeps the provider's error message, which can quote part of the request. See our
Data Posture page for the full breakdown.
Infrastructure
Spendline is hosted on Railway, which provides managed infrastructure with automated TLS, private networking between services, and environment-level secret management. Our database runs on managed PostgreSQL (Neon), which keeps a restore history so the database can be recovered to an earlier point in time.
Authentication and Access Control
- Spendline API key authentication with per-key scoping and revocation. Keys are stored as bcrypt hashes.
- Email/password login with bcrypt-hashed passwords and session tokens.
- Team invite flows with expiring invite tokens.
- All sensitive routes require authentication; unauthenticated requests are rejected with 401.
- Rate limiting is applied to all authentication and proxy endpoints.
API Proxy Security
Your provider API keys (OpenAI, Anthropic, etc.) are stored encrypted with AES-256-GCM, using a master key held outside the database, and decrypted only at request time within the proxy. They are never transmitted to the client or logged in plaintext. Connections from Spendline to AI providers are made over TLS.
Security Headers
The Spendline application enforces a strict Content Security Policy (CSP), X-Content-Type-Options, X-Frame-Options and Strict-Transport-Security (HSTS) on all responses.
Vulnerability Disclosure
If you discover a security vulnerability in Spendline, please report it responsibly to fida@spendline.ai. We will acknowledge your report within 48 hours and work to resolve confirmed issues promptly. We do not have a formal bug bounty program at this time but we appreciate responsible disclosure.
Certifications and Compliance
- Spendline does not currently hold SOC 2, ISO 27001 or any other security certification. A SOC 2 audit is planned; planned is not certified, and we will update this page when that changes.
- Data Processing Agreements (DPA): available on request, contact us.
- GDPR/CCPA: we support data subject access requests and deletion requests via email.