Have questions about data privacy and security for Content Syncing? This article covers how data is stored, accessed, encrypted, and shared, and the exact permissions Spekit requests from each source.
For Spekit's company-wide security posture, including the SOC 2 Type II report, infrastructure controls, and the vulnerability disclosure program, see the Spekit Trust Center.
📌 Quick-Jump Topics
1. Data storage and protection
Where is data stored, and how is it protected?
Imported data is stored securely in AWS using industry-standard measures, including AES-256 encryption at rest and TLS 1.2 or higher in transit.
2. Data access and retention
Who can access the data, and under what conditions?
Access is limited to authorized personnel for support, maintenance, and product improvement, under strict confidentiality agreements and internal policies.
How long is data retained?
Data is retained as long as necessary to provide the Spekit services. Specific retention terms are set in Spekit's contractual agreements with customers.
3. Third-party sharing and termination
Is my data shared with third parties?
Data may be shared with third-party sub-processors to provide the Spekit services. The current list of sub-processors and the purpose of each is available at spekit.com/sub-processors.
What happens to my data if I terminate my account?
Data is deleted according to your request or Spekit's data retention policies. You can request a data export before termination.
💡 Pro Tip: If you are winding down an account, request your data export first and confirm you have it before you terminate. Export is easiest to arrange while the account is still active.
4. Authentication and access controls
What authentication methods keep access secure?
Spekit uses secure role-based authentication, including strong passwords and multi-factor authentication. Source connections use the provider's own OAuth, so your credentials stay with the provider and are not accessible to Spekit:
- Google Drive: connects through Google's OAuth.
- SharePoint: connects through Microsoft's OAuth.
- Confluence: connects through Atlassian's OAuth, using your Confluence domain and login. Only page titles and metadata are stored in Spekit, never the page body.
Are there role-based access controls (RBAC)?
✅ Yes. RBAC manages user permissions and access levels based on each person's role in your organization.
5. Encryption and monitoring
Is data encrypted in transit and at rest?
✅ Yes. Using industry-standard encryption protocols.
Is user activity monitored?
✅ Yes. Spekit monitors activity to detect and prevent unauthorized access and anomalies.
6. Permissions Spekit requests
Spekit requests only the access it needs to sync and keep content current. The exact scopes for each source are below.
Google Drive (granted at connection through user consent):
| Scope | Purpose |
|---|---|
drive |
See, edit, create, and delete the user's Google Drive files |
drive.file |
Access limited to files the user opens or creates with Spekit |
drive.metadata.readonly |
Read file information (name, type, owner, modified date) without accessing contents |
drive.activity.readonly |
View file activity to detect changes, updates, and deletions |
userinfo.email |
See the user's primary Google account email |
userinfo.profile |
See the user's basic info (name) to identify who connected the integration |
SharePoint (Microsoft Graph permissions, granted with admin consent):
| Permission | Purpose |
|---|---|
Files.ReadWrite |
Full access to the user's files |
Files.ReadWrite.All |
Full access to all files the user can access |
Sites.ReadWrite.All |
Edit or delete items in all site collections |
User.Read |
Sign the user in and read their profile |
User.Read.All |
Read all users' full profiles |
offline_access |
Maintain access to granted data |
openid |
Sign users in |
All SharePoint permissions are delegated. See the SharePoint article for the one-time Entra admin consent steps.
Confluence (Atlassian OAuth, granted at connection):
Spekit requests read access to Confluence content so it can sync page titles and detect changes. Because only page titles and metadata are stored in Spekit, the page body is never copied out of Confluence. Clicking a synced title opens the live page in Confluence, and only users with Confluence access can view it.
⚠️ To confirm before publishing: the exact Atlassian OAuth scope names for the Confluence integration are not listed here yet. Add them so this table matches the Google Drive and SharePoint tables above, or confirm with the integrations team what should be shown to customers.
7. Data transfer and limits
How is data transferred between Spekit and each source?
Through a secure, encrypted integration interface, for safe and seamless syncing.
Are there limits on what can be transferred?
Yes. Only the data you explicitly choose to sync is shared with Spekit. Controls are in place to keep transfers within usage policies.
8. Revoking access:
You can revoke Spekit's access to a source at any time, in one of two ways.
Google Drive
- From your Google account: open your list of connected apps and revoke Spekit's permissions.
- From Spekit: disconnect the integration directly in the platform.
SharePoint
From your Microsoft account: open your connected apps and remove Spekit's permissions.
From Spekit: disconnect the SharePoint integration in Settings.
Confluence
From your Atlassian account: open your connected apps and remove Spekit's permissions.
From Spekit: disconnect the Confluence integration in Settings.
ℹ️ Note: Revoking access stops further data interactions, but content already imported may be retained in line with Spekit's data retention policies. For Confluence, the only imported data is page titles and metadata.
💡 Pro tip: Revoking access at the provider (Google, Microsoft, or Atlassian) and disconnecting inside Spekit are two different actions. To fully cut a connection, do both, so no account is left connected on either side.