Security and data at Spectacled.
Spectacled runs on Microsoft Azure in the United States. Each agency's records are isolated, AI assessments and writing are logged with their prompts, and we sign a data processing agreement with every agency that asks.
Updated
Is Spectacled SOC 2 compliant?
Spectacled doesn't have its own SOC 2 report yet. It runs on Microsoft Azure, whose infrastructure is audited for SOC 2 Type II, and we sign a data processing agreement (DPA) with every agency that asks.
| Question | Answer |
|---|---|
| SOC 2 report for Spectacled | Not yet |
| SOC 2 for the infrastructure | Yes: Microsoft Azure, SOC 2 Type II |
| Data processing agreement | Yes, on request, with the list of services that process your data |
| Where data is stored | Microsoft Azure, United States (East US 2) |
| Encryption | TLS in transit; Azure storage encryption at rest |
To request a DPA, email hello@spectacled.ai or ask on your demo call.
How does Spectacled use AI with my data?
AI features run on Azure OpenAI Service, inside the same cloud as your data. Microsoft doesn't use your prompts or outputs to train OpenAI's models.
- Candidate assessments and the pitches and emails Spectacled writes are logged with their prompts in your AI audit log.
- Before those requests reach the model, email addresses, phone numbers, LinkedIn links and street addresses are removed. Résumé parsing reads them on purpose, to fill in the record.
- Match scoring is a fixed algorithm, not an AI model, so the same profile and job always give the same score.
- One agency's records are never shown to another. Our privacy policy explains how de-identified, aggregated data helps improve matching.
- Your recruiters make every hiring decision; scores and assessments inform it.
Who can see what?
Roles decide who manages settings, API keys and the Claude connector, and who sees fees, rates and candidate pay. Clients and candidates see only what you share with them.
Your team
Roles for admin settings, API keys and the connector. Fees, bill and pay rates and candidate pay are hidden from roles that shouldn't see them. Passkeys and authenticator apps for sign-in.
Clients and candidates
Portals show only what you share. Review links need no login and expire after 48 hours; share-link previews never include names or contact details.
AI assistants
The Claude connector is scoped to the person who connects it, never deletes records or emails anyone except them, and can be revoked anytime.
