Roles
The customer is the APP entity / data controller. SpectraIQ acts as data processor and subprocessor of authorised processors.
Scope
Processing is limited to providing the contracted services and complying with documented customer instructions and applicable law.
Subprocessors
Current list at /legal/subprocessors. Customers are notified 30 days before any material change.
Security
We maintain the controls described at /legal/security.
International transfers
Data residency in AWS Sydney by default. Other regions only with documented contractual safeguards.
Audit
Annual SOC 2 Type II report available under NDA.
Termination
On termination we delete customer data within 30 days unless legal retention applies.