Data Flow & Residency Map

This page describes where your data physically goes when you use Spec AI. It is written for security reviewers and procurement compliance teams assessing the platform against regimes such as Saudi PDPL and the NCA Cloud Cybersecurity Controls, UAE PDPL, and UK/EU GDPR. Nothing here is a certification claim — it is a description of how the software behaves, which you can verify in your own audit trail.

The two modes

Each workspace runs in one of two modes, selected by the workspace owner in Settings → Data residency.

• Standard. Documents you paste or upload, extracted figures, and generated outputs are stored in Spec AI's managed database so you can reopen them later. AI runs on our managed model gateway.
• Tenant-resident. Document content is never written to Spec AI's database. It is read from your Microsoft 365 tenant at the moment it is needed, processed in memory for the length of one request, and discarded. AI calls go to a model endpoint you own, in a region you choose.

The four planes

1. Documents

Quotes, specifications, and emails live in your Microsoft 365 tenant (Outlook, OneDrive, SharePoint). Spec AI reads them through Microsoft Graph using read-only delegated permissions granted by you: Mail.Read, Files.Read.All, and Sites.Read.All. Access tokens are stored encrypted with AES-256-GCM and can be disconnected at any time.

In tenant-resident mode, what Spec AI keeps from a scan is a pointer list only: Microsoft item identifiers, titles, timestamps, and a content hash. Message body previews are not retained. In Standard mode a short preview is retained so the import list is browsable offline.

2. Extracted data

Supplier records, price tiers, MOQs, lead times, and the figures the comparison maths produces are structured business data, not documents. These are stored in your workspace so the platform can compare, rank, and export them. Row-level security scopes every row to your account.

In tenant-resident mode, the original quote text behind those figures is not stored — only the numbers and a hash of the source document.

3. AI processing

Standard workspaces use Spec AI's managed gateway. Tenant-resident workspaces send model requests to the OpenAI-compatible endpoint you configure — for example an Azure AI Foundry deployment in your own region and subscription — using your own API key. If that endpoint is not configured, AI features are blocked outright rather than falling back to our shared gateway. That refusal is enforced on the server, not in the interface.

4. Audit trail

Every AI call, every Microsoft read, every outbound lookup, and every change to your residency settings is written to an append-only audit log scoped to your account. It records the action, the resource, the data class involved, the processor and region that handled it, and whether any content was stored. You can read and export it, but you cannot edit or delete entries. See your audit trail.

Outbound lookups

Two features reach the public internet: supplier web-presence checks (fetching a supplier's own website) and live duty-rate lookups (public USITC and UK Trade Tariff APIs). Both can be switched off per workspace, in which case the server refuses the request rather than performing it.

Always outside the tenant

Regardless of mode, three things are handled by third parties and cannot be moved into your tenant: authentication and the workspace database (our managed cloud backend), payment processing (our merchant of record), and application hosting. Full details and the subprocessor list are in the Privacy Policy. Customers who require these to be in-region as well need a self-hosted deployment; contact us for that arrangement.

What this is not

Selecting tenant-resident mode does not by itself make your organisation compliant with any specific law, and Spec AI does not claim any certification on the basis of it. It is a technical control that reduces what leaves your tenant. Your compliance team should assess it alongside your own contracts, hosting, and Microsoft 365 configuration.