Security at Spun

Where your data lives

Germany first, with one US cell

Spun runs two data cells. eu-1 is in Nuremberg, Germany, on Hetzner infrastructure; it holds the control plane and the large majority of organisations. us-1 is in Manassas, Virginia, on netcup infrastructure. Two organisations are homed there today; every other organisation is in Germany.

Placement is not guessed from where you happened to be when you signed up. No country is mapped to a cell, so new organisations are created on the EU cell. Your organisation is homed on exactly one cell, and its data stays on that cell until someone deliberately moves it.

Media — images, video, audio and document attachments — is stored in Cloudflare R2 and served only through signed URLs scoped to a single object, never from a public bucket address.

Retention is your decision. We do not delete your messages on a schedule of our own choosing — data stays until you delete it, or until a retention window you configure removes it. The deletion and export tools below are the mechanism.

PII redaction

What gets stripped, and when

Redaction runs on our server before the request leaves it. Detected values are replaced with opaque placeholders, and the map from placeholder back to the original value is never sent to the browser or to the provider.

One rule holds at every setting: card numbers, bank and IBAN details, payees, national ID numbers, passport numbers, API keys and tokens are stripped from anything used to build search indexes. Detection covers ten language groups and validates what it can — card numbers and Israeli ID numbers are checksum-verified rather than pattern-matched alone.

Redaction reduces what a provider sees. It does not un-send anything already processed, and we say so on the confirmation dialog rather than in a footnote.

Access

Who can reach what

Isolation between organisations is enforced by the database, not by application code remembering to filter. Tenant tables have row-level security policies keyed on the organisation in the current session, so a query without that context returns nothing.

Two roles apply to your team — organisation manager and organisation user — alongside a platform-administrator role held by Spun staff for support. Inbox access is scoped separately again: read-write, read-only, or filter-limited, where a member only sees conversations matching the filter set for them. Conversations shared with another organisation carry their own role on top of that, from viewer through team member and manager to full control, so sharing a thread does not hand over the account.

Identity comes from Firebase, and stops there. Membership, active organisation and role are resolved from the database on every request; nothing in the token is trusted to assert them.

Self Proxy

What Self Proxy is, and what it can see

WhatsApp treats a connection from a data-centre IP address differently from one that looks like an ordinary business connection. Self Proxy exists so that your WhatsApp channel can connect through an IP address you control: you run a small tunnel program on a computer at your own premises, and your channel's traffic exits to WhatsApp from there.

The path is: the WhatsApp gateway connects to a port on a Spun relay server, the relay forwards that connection down a TLS tunnel your computer opened outbound, and your computer makes the final connection to WhatsApp. Because the tunnel is opened outbound, nothing needs to be exposed on your network — no port forwarding, no inbound firewall rule.

Relays run in Nuremberg and Manassas, and the one nearest your computer is used. Health checks poll each configuration continuously and mark it unhealthy, then offline, when it stops responding; when a relay itself is down, that is distinguished from your computer being down so you do not get a false alarm. Self Proxy is optional — organisations that do not enable it never touch this path at all.

Certifications

What we do not claim