Have questions about data privacy and security for Content Syncing? This article covers how data is stored, accessed, encrypted, and shared, and the exact permissions Spekit requests from each source.
For Spekit's company-wide security posture, including the SOC 2 Type II report, infrastructure controls, and the vulnerability disclosure program, see the Spekit Trust Center.
1. Data storage and protection
Where is data stored, and how is it protected?
Imported data is stored securely in AWS using industry-standard measures, including AES-256 encryption at rest and TLS 1.2 or higher in transit.
2. Data access and retention
Who can access the data, and under what conditions?
Access is limited to authorized personnel for support, maintenance, and product improvement, under strict confidentiality agreements and internal policies.
How long is data retained?
Data is retained as long as necessary to provide the Spekit services. Specific retention terms are set in Spekit's contractual agreements with customers.
3. Third-party sharing and termination
Is my data shared with third parties?
Data may be shared with third-party sub-processors to provide the Spekit services. The current list of sub-processors and the purpose of each is available at spekit.com/sub-processors.
What happens to my data if I terminate my account?
Data is deleted according to your request or Spekit's data retention policies. You can request a data export before termination.
💡 Pro tip: If you are winding down an account, request your data export first and confirm you have it before you terminate. Export is easiest to arrange while the account is still active.
4. Authentication and access controls
What authentication methods keep access secure?
Spekit uses secure role-based authentication, including strong passwords and multi-factor authentication. Source connections use the provider's own OAuth, so your credentials stay with the provider and are not accessible to Spekit:
- Google Drive: connects through Google's OAuth.
- SharePoint: connects through Microsoft's OAuth.
- Confluence: connects through Atlassian's OAuth, using your Atlassian Site URL and login. Only page titles and metadata are stored in Spekit, never the page body.
- Notion: connects through Notion's OAuth. You grant access to the specific pages you select. Only page titles and metadata are stored in Spekit, never the page body.
Are there role-based access controls (RBAC)?
Yes. RBAC manages user permissions and access levels based on each person's role in your organization.
5. Encryption and monitoring
Is data encrypted in transit and at rest?
Yes, using industry-standard encryption protocols.
Is user activity monitored?
Yes. Spekit monitors activity to detect and prevent unauthorized access and anomalies.
6. Permissions Spekit requests
Spekit requests only the access it needs to sync and keep content current. The exact scopes for each source are below.
Google Drive (granted at connection through user consent):
| Scope | Purpose |
|---|---|
drive |
See, edit, create, and delete the user's Google Drive files |
drive.file |
Access limited to files the user opens or creates with Spekit |
drive.metadata.readonly |
Read file information (name, type, owner, modified date) without accessing contents |
drive.activity.readonly |
View file activity to detect changes, updates, and deletions |
userinfo.email |
See the user's primary Google account email |
userinfo.profile |
See the user's basic info (name) to identify who connected the integration |
SharePoint (Microsoft Graph permissions, granted with admin consent):
| Permission | Purpose |
|---|---|
Files.ReadWrite |
Full access to the user's files |
Files.ReadWrite.All |
Full access to all files the user can access |
Sites.ReadWrite.All |
Edit or delete items in all site collections |
User.Read |
Sign the user in and read their profile |
User.Read.All |
Read all users' full profiles |
offline_access |
Maintain access to granted data |
openid |
Sign users in |
All SharePoint permissions are delegated. See the SharePoint article for the one-time Entra admin consent steps.
Confluence (Atlassian OAuth, granted at connection):
On the Atlassian authorization screen, Spekit requests read-only access to Confluence:
| Access | Purpose |
|---|---|
| View: Page | Read Confluence pages so Spekit can sync page titles and detect changes |
| Search: Confluence | Search Confluence to find the pages you choose to sync |
Access is limited to the Atlassian sites where you have access and the Spekit app is installed. Because only page titles and metadata are stored in Spekit, the page body is never copied out of Confluence. Clicking a synced title opens the live page in Confluence with the View in Confluence button, and only users with Confluence access can view it.
Notion (Notion OAuth, granted at connection):
On the Notion authorization screen, Spekit requests access to the pages you select:
| Access | Purpose |
|---|---|
| View pages you select | Read the pages you choose to share, so Spekit can sync them and detect changes |
| Edit pages you select | Make changes to the pages you choose to share |
| Create new content within pages you select | Add new content inside the pages you choose to share |
| View workspace users and their emails | Identify who connected the integration and manage access |
Access is limited to the specific pages you select at connection. Notion does not share your whole workspace. Only page titles and metadata are stored in Spekit, never the page body. Clicking a synced page opens the live page in Notion with the View in Notion button, and only users with Notion access can view it.
7. Data transfer and limits
How is data transferred between Spekit and each source?
Through a secure, encrypted integration interface, for safe and seamless syncing.
Are there limits on what can be transferred?
Yes. Only the data you explicitly choose to sync is shared with Spekit. Controls are in place to keep transfers within usage policies.
8. Revoking access
You can revoke Spekit's access to a source at any time, in one of two ways.
Google Drive
- From your Google account: open your list of connected apps and revoke Spekit's permissions.
- From Spekit: disconnect the integration directly in the platform.
SharePoint
- From your Microsoft account: open your connected apps and remove Spekit's permissions.
- From Spekit: disconnect the SharePoint integration in Settings.
Confluence
- From your Atlassian account: open your connected apps and remove Spekit's permissions.
- From Spekit: disconnect the Confluence integration in Settings.
Notion
- From your Notion account: open your connected apps and remove Spekit's access.
- From Spekit: disconnect the Notion integration in Settings, or from Team Hub → + Add New → File Sync → the Notion tab.
ℹ️ Note: Revoking access stops further data interactions, but content already imported may be retained in line with Spekit's data retention policies. For Confluence and Notion, the only imported data is page titles and metadata.
💡 Pro tip: Revoking access at the provider (Google, Microsoft, Atlassian, or Notion) and disconnecting inside Spekit are two different actions. To fully cut a connection, do both, so no account is left connected on either side.