Trust & Security

Spell QMS Pro runs with a tier-1 cloud provider in the US East region. The application runs inside a private network with no direct internet ingress: a single internet-facing load balancer terminates TLS and forwards to compute workloads running in private subnets with no public addresses and no outbound public-internet route. Container images, secrets, and log traffic move over private network endpoints — not over the public internet.

Each release is a signed, immutable container image. The image registry blocks tag mutation and runs scan-on-push.

In transit. All public traffic is HTTPS using TLS 1.2 or TLS 1.3 with modern ciphers. HTTP requests are 301-redirected to HTTPS. Database connections require TLS.

At rest. Application data is stored in a managed relational database with AES-256 encryption using managed encryption keys. Documents and evidence files are stored in encrypted object storage with AES-256 server-side encryption, public access blocked, and versioning enabled. Compute storage volumes are encrypted.

For your users. Authentication uses JWT access + refresh tokens with short-lived access tokens. Tenant administrators define roles and permissions. Every create / update / delete is associated with a specific user and timestamped.

For our operators. Production access requires SSO, hardware MFA, and short-lived role-assumed credentials. We never use long-lived access keys. Direct database access is logged and used only to diagnose incidents.

The public load balancer is fronted by a managed web application firewall with rule sets covering common web exploits, known bad inputs, and IP reputation, plus a per-IP rate limit. Only the load balancer accepts inbound 443 from the internet. The application workloads only accept inbound from the load balancer. The database only accepts inbound from the application workloads. There are no “0.0.0.0/0” ingress rules anywhere except on the load balancer on ports 80/443.

• HSTS, X-Content-Type-Options, Referrer-Policy, X-Frame-Options DENY, secure cookies.
• CSRF allow-list scoped to your custom domain.
• CORS allow-list (no wildcards).
• The API layer validates every request — input is checked at every endpoint.
• JWT signing key, database credentials, and integration tokens are stored in an encrypted secrets vault — never in container images, env files, or git.
• Dependencies are pinned and scanned; container images are rebuilt on patch availability.

Database snapshots run automatically with 7-day point-in-time recovery and a longer weekly snapshot retained per the configured plan. Object storage has versioning enabled. Deletion-protected resources require explicit operator confirmation. We test restore procedures regularly.

We collect application logs, infrastructure logs, and platform metrics through centralized observability. Critical alarms (5xx error rate, target health, database CPU, certificate expiry) page the on-call engineer.

Suspected security incidents are triaged within 1 hour of detection. We notify affected customers without undue delay (and within applicable legal timelines) when their data is implicated. Post-incident, we publish a written root-cause analysis and remediation plan.

Spell QMS Pro is designed to align with the controls required by ISO 13485, ISO 9001, and analogous quality standards: full audit trail of data changes, controlled documents with version history, electronic-signature-ready approvals on management reviews, and CAPA effectiveness verification. The system is a tool to support compliance — your formal regulatory standing remains your responsibility.

Customer Content is retained for the lifetime of your subscription plus a wind-down period described in our Privacy Policy. On termination you may export your data; thereafter we delete it. Server logs retain typically 30 days.

A current list of sub-processors (cloud hosting, email delivery, error monitoring) is available on request to security@spell.solutions. Each sub-processor is engaged under a written data-processing agreement.

If you believe you have found a security vulnerability, please email security@spell.solutions with reproduction steps. Do not access data that is not yours, do not run automated tests against production without prior coordination, and give us a reasonable window to remediate before public disclosure. We acknowledge in good faith and will not pursue legal action against researchers who follow this policy.

Spell Solutions, 1000 Main Street, Suite 2300, Houston, TX 77002, USA. security@spell.solutions.