Skip to content

Security and your data

How SpecsGraph Cloud will treat your data once it launches: what it will store, how access will be limited, and how you will export a workspace.

Note

SpecsGraph Cloud is coming soon

Cloud is not available yet, so there is nothing to sign up for or pay for today. The self-hosted edition is available now: the complete product, free, on your own servers. Start with the self-hosting overview.

Your specs will stay in your repository

On Cloud, as on a self-hosted install today, every approved change will be committed to your own GitHub repository, in specsgraph/. The published spec will be Markdown and graph.json in your Git history, not a record locked inside Cloud, so anyone with access to the repository can read it, diff it and keep it, with or without SpecsGraph running.

Cloud will hold the working side of the spec: proposals under review, threads, workstreams and the history that links each revision to the discussion behind it. The export described below will cover all of that.

What Cloud will store

DataWhy it will be stored
The graph of each project, with every revisionIt is the model you and your agents edit.
Proposals, review threads, decisions and workstreamsThey carry the reasoning behind each revision.
Members, their roles and sign-in detailsTo know who can do what in the workspace.
Personal access token details: name, access, projects, expiry and last useTo check agent requests and show your token list. The full token is shown only once, when you create it.
The GitHub App installation and each project's repository settingsTo publish approved changes.
Plan and billing detailsTo run your subscription.

The GitHub App will have the permissions listed in Connect GitHub, on the repositories you select. GitHub has no permission scoped to one folder, so its contents access covers the whole repository; SpecsGraph writes only inside each project's spec folder, and every write is a commit you can inspect.

Access and tokens

Cloud will use the same access controls as the self-hosted edition you can run today:

  • Sign-in. People sign in with their GitHub account, and only members of the workspace can open it.
  • Roles. Each member has one role: Owner, Admin, Editor, Viewer. Approval is limited to Editor and above, and only people approve. Members and roles has the full table.
  • Personal access tokens. Agents authenticate with a token that starts with sgp_, so you can add a secret-scanning pattern that catches a leaked one. SpecsGraph shows each token once and cannot show it again.
  • Scoped and revocable. A token carries an expiry, an access level and the projects you select, and never exceeds its owner's role. Revoking it stops the agent at its next request.
  • Token policy. An Admin sets the workspace's token policy. Removing a member from the workspace revokes every token they own.
  • GitHub least privilege. The GitHub App reaches only the repositories you select, with short-lived credentials GitHub issues per installation.

Traffic to the web app and the MCP server will use HTTPS. Personal access tokens covers creating, rotating and revoking tokens.

What Cloud will operate for you

On Cloud, the operational work of running SpecsGraph will be ours. It is the same list you own when you self-host today.

AreaOn Cloud
Hosting and network securityWe will run the servers, TLS and network access controls.
Updates and security patchesCloud will stay on the current release, so you will not schedule upgrades.
BackupsWe will take automatic backups and restore them when you ask.
GitHub AppAn App run by SpecsGraph, ready on day one. You will install it on your repositories.

Export your workspace

You will be able to export a Cloud workspace at any time, not only when you leave, the same way a self-hosted install exports today: an Owner opens Workspace settings, then Export and chooses Export workspace. SpecsGraph prepares one archive, for example northwind-commerce-export.zip, with every project in the workspace: the graphs with their full revision history, proposals with their threads, decisions, workstreams, members with their roles, and project settings.

The archive contains member names and email addresses and your unpublished work, so store it where you keep other sensitive files. Personal access tokens are not in it, so everyone creates new ones after an import, and a Cloud export will also leave out the GitHub App installation and billing details. The archive is made for importing into SpecsGraph running the same release it was exported from, and its layout can change between releases, so build scripts on graph.json in your repository instead; see Spec files in your repository.

Enterprise options

Enterprise is the plan we intend for organizations with stricter requirements. It is not available yet. As planned, it will include everything in Team, plus:

  • Dedicated single-tenant hosting in your region
  • Custom contracts
  • Security reviews
  • Named account lead

If your security team will want to review Cloud before you adopt it, tell us what they look for.

Report a vulnerability

If you find a security issue in SpecsGraph, email us through the contact address instead of opening a public issue. Include what you found, how to reproduce it and which version is affected. We acknowledge reports and follow up with you while we investigate.

Next steps