Security & trust

Where your data lives, who maintains it, and how it leaves.

Before you hand a tool your vendor master, you should know where it sits and what happens to it. Here’s the straight version.

Hosted entirely on Microsoft Azure

Your data lives in Microsoft Azure — the same cloud that runs a large share of the Fortune 500, with Microsoft’s physical security and network protection underneath it.

Stored in the United States

All SpendAware data is hosted in US-based Azure regions. Your vendor master, your spend file, and everything we derive from them stay in the United States — they don’t leave the country.

Fully managed platform (PaaS)

We run on Azure platform services, not servers we hand-maintain — an Azure SQL database and managed web hosting. Microsoft patches, updates, and keeps the infrastructure current, so there’s no un-patched box sitting between you and your data.

Backups handled by the platform

Automated backups run inside Azure as part of the managed database — point-in-time protection maintained by Microsoft’s platform, not a script we have to remember to run.

Encrypted in transit and at rest

Traffic to SpendAware travels over TLS, and your data is encrypted at rest in Azure. Access is scoped to your organization’s workspace and the users you invite.

Your data stays yours

We don’t sell your data and we don’t train public models on it. Your vendor master and spend file are used to produce your analysis — nothing else.

You delete it — and it’s gone

You can delete all of your own data yourself, whenever you want. Deletion is permanent: once you remove a dataset, or cancel your subscription and your data is deleted, it cannot be rebuilt or recovered — by you or by us.

No implementation footprint

There’s no agent to install and no standing connection into your ERP. You export two files and upload them — nothing reaches back into your systems.

What Microsoft handles, and what you control

Running on Azure’s managed platform means a clear split. Microsoft maintains the foundation — the physical data centers (in the United States), the network, the operating systems, security patching, database updates, and automated backups of the managed database. We don’t run our own servers to fall behind on, and neither do you.

You control your data. You decide what to upload, you review what the AI does with it, and you can delete all of it on your own, at any time. Because deletion is permanent, cancelling your subscription and removing your data is final — there’s no shadow copy we could restore from later.

SpendAware is in active development ahead of general availability. As we approach launch we’ll publish further specifics on data residency and retention. If your team has a security review or questionnaire, we’re glad to work through it — get in touch.