Data processing

Roles

For documents your people write in Specio, you are the controller and we are the processor. We process them only to provide the service and on your instructions. We do not sell them, and we do not use them to train models.

What we process

• Account data — name, email address, and the workspaces and organisations someone belongs to.
• Content — documents, comments, uploaded files and images.
• Usage records — counts of AI actions, storage totals, and the days a member was active. Counts, never what was written.
• Administrative log — who invited whom, who changed a role or a setting. Deliberately contains no reference to any document.

Sub-processors

These are the third parties that may process customer data. We give notice before adding one.

• Supabase — database, authentication and file storage.
• Vercel — application hosting and edge delivery.
• Resend — transactional email. Addresses and message bodies only.
• Model providers — for AI features. On Institution you may supply your own provider credentials, in which case prompts go to your provider under your contract and not ours.

Deletion and return

Any account can export everything it holds at any time, without asking us. Closing an account is scheduled thirty days out and reversible throughout. An organisation may set a retention period; it is off by default.

Security measures

Set out on the security page, including the structural separation that stops an organisation administrator reading a member’s documents, and our incident-notification commitment.

Getting a signed DPA

Write to legal@specio.space with your institution’s name and, if you have one, your own template — most universities do, and we would rather start from yours than argue about ours.

We deliberately do not offer a click-to-accept DPA. A data processing agreement is a contract between two named parties, and one signed against text nobody reviewed protects neither of us.