Your sales data stays yours.
Spiich is ISO 27001 certified, offers optional EU data residency, and never trains AI models on your data. Your admin decides what it can touch in your CRM.
Certified to the standards your security review starts with.
ISO/IEC 27001:2022
Certified for how the Spiich platform is built, run and supported, including its cloud production environment. Maintained through annual surveillance audits.
CASA Tier 2
Completed November 2025.
GDPR
You contract with a Swedish company under a GDPR-based Data Processing Agreement, with notice of a confirmed personal-data breach within 48 hours.
You stay in control.
You approve the access
Spiich reaches your CRM only through the OAuth scopes an admin approves, with object and field-level locking. Disconnect it in one click and its stored tokens are cleared.
Email is read, never obeyed
Email, calendar invites and web pages an agent reads are treated as untrusted input, never as instructions. Writes carry guardrails against bulk changes.
Never used for training
Customer content is never used to train or fine-tune AI models. Every model provider works under zero data retention.
EU data residency
Optional. With it, the application, databases and AI inference run in the EU/EEA, and backups sit in at least two EU regions.
Encrypted in transit and at rest
TLS 1.2 or higher on all public endpoints. AES-256 at rest for databases and object storage.
Isolated per customer
Every customer's data is logically isolated from every other tenant's, enforced at the data layer and again on every request.
Asked in every security review.
Security question, document request or vulnerability report? Email hello@spiich.ai.
Does Spiich use customer data to train or fine-tune AI models?
No. Customer content is never used to train or fine-tune AI models, and our terms say so. Every model provider contractually commits to zero data retention and to never training on customer data, with inference running in the EU/EEA if you choose EU data residency. See the Terms of Service.
Where does Spiich store and process customer data?
Spiich offers optional EU data residency: with it, your production data, including the application, databases and AI inference, is stored and processed in the EU/EEA, and backups sit in at least two EU regions. The one exception is agent web search, which in every case sends agent-generated queries, not attributed to your company, to a limited set of web-search providers outside the EU/EEA. By default, data may be stored and processed worldwide, including in the United States. Sub-processors are engaged under a Data Processing Agreement; where one sits outside the EU/EEA, the transfer is covered by an adequacy decision or the EU standard contractual clauses.
Is Spiich SOC 2 or ISO 27001 certified?
Spiich is ISO 27001 certified, to ISO/IEC 27001:2022 under certificate 110826-1, issued in August 2026 and valid to 10 August 2029. The scope covers the development, operation, delivery and support of the Spiich platform, including its cloud production environment, product engineering, customer support and associated internal business operations, and is maintained through annual surveillance audits. We also hold a CASA Tier 2 assessment (TAC Security, November 2025). SOC 2 is on our compliance roadmap.
Is Spiich GDPR compliant?
Yes. You contract with Spiich Labs AB, a Swedish company, under a GDPR-based Data Processing Agreement, and Spiich offers optional EU data residency: with it, your production data is stored and processed in the EU/EEA. Customers can request export or deletion of recordings, transcripts and associated data. Our privacy policy is public. See the Data Processing Agreement.
Does Spiich support SSO (SAML/OIDC)?
Not yet. SSO via SAML and OIDC is in progress. Today your team signs in with Google or with email and password, and admins can require an emailed two-factor code for every password sign-in. See how two-factor sign-in works.
What is Spiich’s data export policy?
Customer data is available for export for 30 days after termination. After that it is deleted, except for copies in routine backups, which are purged on our standard backup cycle, and data we are legally required to retain. See the export and deletion terms in the Service Agreement.
What documentation can we get for a security review?
On request: our ISO 27001 certificate and Statement of Applicability, the Data Processing Agreement, the sub-processor list, the CASA Tier 2 assessment, an architecture and data-flow overview, and a DORA addendum for regulated financial institutions. We also answer security questionnaires. See the security measures in the Service Agreement.
Start Closing.