Platform · Security & privacy
Security you can check, limits we state plainly
Spy Monk holds sensitive things: who you are watching, what was said, the evidence you collected. This page lists the controls that protect them today, how each was verified, and the items still open before we call the platform production-ready. No system is perfectly secure, and we do not claim otherwise.
Updated By Drive Digital Editorial
Controls verified on the production stack · Open items published, with owners · Nothing marked done that is not
Direct answer
How does Spy Monk protect my data?
Each workspace is isolated at the data layer and every request is checked against it. Secrets such as two-factor keys are encrypted at rest with AES-256-GCM; sessions use short-lived tokens with hashed refresh tokens; evidence carries a SHA-256 fingerprint; hosting is hardened with TLS 1.2+, strict headers and non-root containers. Malware scanning, object-lock storage and a penetration test remain open.
- Access token 15 minutes; refresh token 30 days, stored hashed, rotated on use, revoked on sign-out
- Two-factor authentication (TOTP) with ten single-use recovery codes stored hashed
- Payments verified by the gateway's signature before anything activates; production refuses to run without real keys
- Open before production: real-time malware scanning, write-once evidence storage, independent penetration test
Approach
Evidence for the controls, not adjectives
Security pages usually say "bank-grade" and stop. We prefer to say what is in place, how it was checked and what is not finished, because customers who handle reputation incidents are exactly the people who should be sceptical of unverified assurance.
Three layers protect a Spy Monk workspace. The application enforces tenant isolation on every query, role-based permissions, rate limits, signed payments and an audit trail. The data layer encrypts secrets, hashes tokens and fingerprints evidence, and runs on a database account that cannot alter the schema. The hosting layer — the production stack we ship — terminates TLS 1.2 and 1.3 only, sends strict security headers, runs every service as a non-root user on a read-only filesystem, publishes only ports 80 and 443, and takes encrypted backups whose restore has been rehearsed.
Each control below was verified on the production stack with a recorded command and result; the register with that evidence is maintained by our operations team and reviewed at every release. Where a control is still being built, it says so on this page, in the release gates and in the product.
In place today
Application controls
- Available now
Tenant isolation
Every business table carries the workspace id and every query is scoped to it. An id that belongs to another workspace returns the same not-found response as an unknown id, and the attempt is written to the audit log.
- Available now
Roles and approvals
Owner, Admin, Analyst and Viewer. Billing, member management and approvals need Admin or above. Nothing external happens without an approval record.
- Available now
Sign-in and two-factor
Passwordless one-time codes (hashed, ten-minute validity, five attempts, throttled) or Google sign-in; optional TOTP two-factor with ten hashed, single-use recovery codes.
- Available now
Sessions
Fifteen-minute access tokens; thirty-day refresh tokens stored hashed, rotated on every use and revoked on sign-out. Reuse of a rotated mobile token revokes the whole family.
- Available now
Encrypted secrets
Two-factor secrets, connector tokens and every provider key saved by an administrator are encrypted at rest with AES-256-GCM under a per-installation key.
- Available now
Safe fetching
When Spy Monk fetches a page you submit, it resolves the address once, refuses private networks, pins the connection and caps redirects, size and time — so a hostile link cannot reach internal systems.
- Available now
Payment verification
Checkout and webhook signatures are verified; capture is exactly-once; invoice numbers come from a gap-free series; production without gateway keys refuses orders rather than falling back to a demo.
- Available now
Rate limits and audit trail
120 requests a minute per address, strict limits on one-time codes and on the public enquiry form; authentication, billing, case transitions and member changes are logged.
- Available now
Input validation
Every request body is validated against schemas shared with the interface; free text from the public enquiry form is stored escaped; raw IP addresses are never stored.
Hosting
The production stack, as shipped
What the one-command deployment configures, with the check used to verify it.
| Control | How it was verified |
|---|---|
| TLS 1.2 and 1.3 only, automatic certificates, HTTP redirected to HTTPS | Older protocols refused in a handshake test; plain-HTTP request answered with a permanent redirect |
| Strict headers: HSTS, nosniff, Referrer-Policy, frame denial, Permissions-Policy, Content-Security-Policy | Response headers inspected on web and API; checked on every page response in a load test |
| Only ports 80 and 443 published; database and cache on an internal network; host firewall default-deny | Container port bindings and firewall status inspected on a clean installation |
| Non-root services, read-only root filesystems, dropped capabilities, resource limits | Process owners and container settings inspected; a write to the application directory is refused |
| Database account without superuser or schema rights; migrations by a separate role | Role attributes queried; a table creation as the application role is refused |
| Encrypted backups with a rehearsed restore | Backup and restore drill executed and recorded in the deployment evidence |
| Access logs without query strings, cookies or authorisation headers; client addresses truncated | Edge log format inspected |
| Secrets scanning of the full history and dependency audits in continuous integration | Security workflow runs on every change |
Source: docs/security (control register, threat model, OWASP ASVS Level 1 mapping, CSP specification) and docs/deploy/evidence.md. Sandbox verification 7–8 November 2026; an external penetration test remains a production gate.
Privacy
What we collect, and what we refuse to do
Spy Monk processes the minimum needed to run audits, monitoring and cases: your account details, the entities and keywords you ask about, the public content found in covered sources, the evidence and notes you add, and billing records. Card and UPI details are handled by the payment provider and never stored by Spy Monk.
We do not buy or sell personal data. We do not access private messages, closed groups or accounts without explicit permission through a platform's official consent screen. We do not try to identify anonymous reviewers or authors. Archiving a mention hides it in Spy Monk and never deletes it at the source.
Public content about other people — reviewers, journalists, commenters — is shown only to the customer who asked for the audit, with its source, and is never combined with private data or built into profiles. Our draft privacy notice sets out the legal basis and your rights under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, and is marked as pending review by qualified counsel.
Honesty about gaps
Open items before production
These are tracked in our release gates with owners. Staging with trusted testers is acceptable with them open; production is not.
- Real-time malware scanning of uploaded evidencePhase 2Executable types are refused today; a scanning interface exists and awaits a scanner.
- Write-once (object-lock) evidence storagePhase 2Evidence is immutable through the API and the interface; storage-layer enforcement follows.
- Independent penetration testPending feasibilityA production gate; scheduled with an external tester before launch.
- Database row-level security as a second isolation layerPhase 2Application-level isolation is in place and tested.
- Screen-reader accessibility passPhase 2Automated accessibility checks pass; the manual pass is outstanding.
- Centralised observability and alertingPhase 2Health checks and structured logs exist; tracing dashboards follow.
- Single sign-on for enterprisesPending feasibilityPhase 5.
- Phase 2
- Phase 25 items
- Pending feasibility
- Pending feasibility2 items
Questions
Security and privacy questions
Where is my data stored?
The hosting region and the AI provider's data residency are decided at deployment and will be recorded in the privacy notice before launch; hosting in an Indian region is the stated preference. The draft notice marks this as an open item rather than assuming it.
Can Spy Monk staff see my cases?
The platform administration console covers accounts, plans, credits, payments, integrations, message delivery and the public enquiry inbox — not your cases, mentions or evidence. Every administrative action requires a stated reason and is written to an audit log with before-and-after values.
Is two-factor authentication required?
It is available to every account and required for platform administrators. We recommend it for Owners and Admins, who can record approvals and change billing.
How do I report a security concern?
Use the grievance page. Describe what you found and how to reproduce it; please do not include passwords or one-time codes. If a personal data breach affects you, we will tell you in plain language what happened, its likely impact, what we have done and how to reach us, and notify the authorities as the law requires.
Do you use cookies or analytics?
Sign-in uses cookies needed to keep your session secure. On the public website, Google Analytics loads only if you press Allow on the consent banner; it is off by default, advertising signals stay off, and you can change your choice from the Cookie settings link. The customer dashboard sends nothing to analytics unless your workspace opts in.
What happens to my data if I close my account?
Personal data is erased when it is no longer needed or when you withdraw consent, unless a law requires us to keep it — for example tax records and security logs for their statutory periods. The draft privacy notice sets out the retention approach and the questions still with counsel.
Questions about security?
Ask before you start. We would rather answer a hard question now than after you have uploaded evidence.
No card needed