Security and data handling

Where Spellwarden runs

Spellwarden runs on AWS in the eu-central-1 region, Frankfurt, Germany. The application runs on AWS Lambda behind Amazon API Gateway. Its data is in Amazon DynamoDB and Amazon S3. Sign-in is handled by Amazon Cognito and email by Amazon SES, in the same region.

Amazon CloudFront delivers the website and the app, so each page is served from the edge location nearest to the visitor. The data itself stays in Frankfurt.

Evals run on Amazon Bedrock. The calls go from Spellwarden's AWS account in Frankfurt to Bedrock's EU cross-region inference profiles, which keep them in EU regions. Runtime traces are received at otel.spellwarden.ai, then processed and stored in Frankfurt.

A few things leave the EU or the AWS account under narrow conditions: the review of rules an organisation chooses to share, the payment data held by the payment provider and the optional analytics on the website. They are listed under What leaves the platform, and to whom.

What we store, and for how long

The table lists each kind of data, how long it is kept and where that is stated. The periods are the same for every organisation: there is no per-organisation retention setting. The retention section of the privacy policy is the full list.

Spellwarden does not read an organisation's content except for support, security or legal reasons, and to review the rules the organisation chooses to share with us. Stored content is shown only to the organisation's owners and managers, and each time it is opened that is recorded in the audit log. Runtime traces explains how content storage is turned on and off.

The database has point-in-time backups for 35 days and deletion protection. The data bucket blocks all public access and keeps no old versions of objects.

What leaves the platform, and to whom

Spellwarden shares data only with the processors needed to run the service and with the destinations an organisation chooses. The table matches the data sharing section of the privacy policy, which is the binding text.

When a scan fetches a public skill from GitHub or GitLab, or looks a server up in the public MCP registry, those services see a request from Spellwarden's servers and receive no personal data. Spellwarden does not sell personal data and does not share it for advertising.

What is sent to AI models, and what is masked

Everything sent to an AI model for an eval is content the organisation has already given Spellwarden. Spellwarden never sends a password, an API key, a connection token or any other Spellwarden credential. Before text is sent, and again before an answer is stored, text shaped like a credential, such as an access key or a token, is masked. Masking recognises patterns, so it cannot guarantee that no secret or personal data is sent: do not put secrets or personal data in the skills and tool descriptions you evaluate. See evals and Amazon Bedrock.

What the scanner sends

The open-source scanner runs on your own computers and CI runners. In free mode it sends your code and files nowhere. In a CI pipeline it sends one short usage message per run, with a fixed list of fields and no file content, which you can switch off. In connected mode it uploads scan results to your organisation: findings with a masked excerpt of at most 300 characters, file paths, package hashes and the run's context, never a whole file. The usage message and the connected mode sections of the privacy policy list every field.

Access

Access to an organisation depends on the person's role in it, on how the person signed in and on that organisation's settings. Single sign-on and reading the audit log are on the Enterprise plan. Sign in and account security and Organisations, members and roles show the screens.

Roles

Every request to an organisation's data is checked against the person's role in that organisation. A person who is not a member gets the same answer as for an organisation that does not exist. A person can give another only a role whose permissions are within their own, and an organisation always keeps at least one owner.

Sign-in and two-factor authentication

• A person signs in with an email address and a password of at least 12 characters, or with Google. Amazon Cognito stores the password as a salted hash: Spellwarden never sees or stores it in plain text.
• Two-factor authentication uses an authenticator app. Text messages are not offered. Cognito holds the authenticator's secret; Spellwarden stores only that two-factor is on and when it was last checked.
• An owner can require two-factor for an organisation. A member who has not turned it on stays a member but is refused that organisation's data until they do. Sign-ins with Google and through single sign-on do not satisfy the requirement, because Cognito does not apply its two-factor to them.
• Sessions use tokens valid 60 minutes and a refresh token valid 12 hours. The app keeps them in the browser tab's session storage, never in a cookie. Signing out in one tab signs out every tab.

Single sign-on

An organisation on the Enterprise plan can connect its own identity provider, through SAML or OIDC. Only an owner sets it up. An owner can then require it: a person must sign in through it to reach that organisation's data. Requiring single sign-on and requiring two-factor are exclusive, so an organisation uses one or the other. A single sign-on identity is linked to an existing Spellwarden account only after the person signs in to that account. When an organisation leaves the Enterprise plan, single sign-on is turned off and people who signed in only through it must be invited again.

API keys and CI credentials

• An API key starts with swk_ so that secret scanners recognise a leaked one. Spellwarden stores a SHA-256 hash of it, its first characters and its last 4 characters, never the full key. The full value is shown once, when the key is created.
• A key belongs to one organisation, has the access level read, write or CI chosen at creation, and an organisation can have 20 active read and write keys. Owners and managers create and revoke keys. A revoked key, or a key of a deleted organisation, stops working.
• A pipeline can exchange its code host's identity token for a CI token that lives 15 minutes, is bound to one repository and one pipeline run, and can only read the organisation and run CI checks.
• Connected apps use OAuth: you sign in and allow the app on a consent screen. Spellwarden stores the authorisation code and the refresh token only as SHA-256 hashes, and you can revoke an app at any time.

On the Enterprise plan, owners and managers can read the audit log of an organisation. It records the actor, the action and the time of changes such as inviting a member, changing a role or a setting, creating or revoking an API key, and starting or removing single sign-on. It never holds a secret. The API and keys guide covers keys in use.

Encryption in transit and at rest

Encryption is described here only as far as the infrastructure and the code show it. The privacy policy states it in one line: encrypted at rest and in transit (TLS), with access limited to what the service needs.

In transit

• The website and the app are served through Amazon CloudFront, which accepts TLS 1.2 or later from visitors.
• The API's custom domain on Amazon API Gateway accepts TLS 1.2 or later. The default API Gateway address is disabled, so requests reach the API only through the Spellwarden domain.
• The data bucket, the bucket that holds received email and the buckets that hold the website refuse any request that is not made over TLS.

At rest

• The database table uses server-side encryption with a key AWS owns and manages.
• The data bucket, the bucket that holds received email and the website buckets use S3 server-side encryption with S3-managed keys, and block all public access.
• The queues that carry received runtime traces use Amazon SQS server-side encryption.
• Passwords are held by Amazon Cognito as salted hashes. Invitation links, API keys, authorisation codes and refresh tokens are stored only as SHA-256 hashes.

Secrets in use

A CI key or CI token is sent only as the authorization header of a request to the Spellwarden API. The scanner never writes it to its output, to a log, to a comment, to a report or to an upload. The client secret of an organisation's OIDC provider is passed to Amazon Cognito and is never stored or logged by Spellwarden. Eval export pushes use no stored secret: for each push, Spellwarden obtains a short-lived credential that the destination accepts, uses it for that push only and keeps none.

Spellwarden's sources do not describe organisation-specific encryption keys. If your review needs a statement about key management beyond what is written here, ask for it as described under Questionnaires.

Deleting data and leaving

Leave an organisation

A member can leave an organisation from their account page. The last owner cannot leave until another person is an owner.

Delete your account

You can delete your account in the app at any time, unless you are the only owner of an organisation that has other members (make someone else an owner first) or you belong to a suspended organisation. Organisations you own alone are deleted with your account. Your profile and sign-in methods are erased and your connected apps are removed. Your past actions in organisations stay in their audit logs as anonymous entries that read Deleted user.

Delete an organisation

An owner can delete an organisation. Members lose access at once. For 1 day after the deletion an owner can restore it; after that it stays closed, and its URL name is never given to another organisation. The API keys of a deleted organisation stop working.

A deleted organisation's records (settings, member list, invitations, audit log and billing references) are kept, never shown to anyone, as the privacy policy's retention section states. Stored runtime content is deleted within 2 hours after the restore window ends. Email addresses in the audit log and in the record of removed members stay. To ask for personal data about you inside a deleted organisation to be erased, write to hello [at] spellwarden [dot] ai.

Remove data without deleting the organisation

• Removing a repository in the dashboard removes the rest of its scan records.
• Turning content storage off deletes the stored content within 2 hours.
• An export you downloaded or pushed to a platform is a copy that belongs to your organisation. Spellwarden does not delete it, and nothing a platform computes from it comes back into Spellwarden.

Under the GDPR you can ask for access to the personal data held about you, its correction or erasure, a restriction, portability or object to processing based on legitimate interest. Where your organisation is the controller of the data in its content, Spellwarden is its processor under Article 28 and passes your request on. The your rights section of the privacy policy has the detail. To receive the data processing terms, write to hello [at] spellwarden [dot] ai.

Reporting a security problem

To report a security problem in Spellwarden, send an email to security@spellwarden.ai. This address is for security reports only: any other question goes to the contact address in the footer.

Say what you found and where: the page, product area or API route, what you saw, the steps that show it, the scanner or product version, and how to reach you. Leave out real credentials, customer secrets and other people's personal data, and do not put them in the first message.

If you need to run tests to confirm the problem, ask first: the terms ask users not to attack, overload or test the security of the service without written permission. Mail to this address is screened for spam before anyone reads it; the inbound email section of the privacy policy describes the screen.

Questionnaires

Send security and procurement questionnaires to the contact address in the footer. Type it into your mail program, writing @ in place of [at] and a full stop in place of [dot]: hello [at] spellwarden [dot] ai. Say which organisation and plan the questionnaire is for, the date you need the answers by, and which answers must be confirmed in writing. A format we can edit is easier than a form we have to retype.

Most answers are on this page and in the privacy policy: who controls the data, the processors, where data is held, retention, transfers and your rights. The terms add acceptable use, suspension and the warranty. The data processing terms are sent on request.

This page states no third-party audit result, no test report and no availability figure, because Spellwarden's sources show none. The terms provide the service "as is" and "as available", without a warranty of uninterrupted availability (see no warranty). A question that these texts do not answer is answered individually, in writing.

Related guides

• Sign-in, two-factor and single sign-on
• Organisations, members and roles
• Runtime traces and sessions
• Skill evals and session evals