TRUST CENTER
Trust Center
Spock is operated by Seleya Labs Inc. This page summarises the facts. The binding terms are in the Terms, Privacy Policy and Data Processing Agreement.
Where data lives
| Service | Where |
|---|---|
| Application servers | Hetzner, Falkenstein, Germany |
| Database | DigitalOcean, Frankfurt, Germany |
| Files | Amazon Web Services S3, Frankfurt, Germany |
| Search index | Cloudflare R2, Western Europe |
| Seleya’s own AI models | Google Cloud GPUs, Dallas, USA |
| Third-party AI models | OpenAI, Google Gemini and Fireworks, USA |
| Our team | South Africa |
Content is stored in Europe. To answer a request, the relevant part of it is processed by an AI model in the United States, either Seleya’s own or a third party’s. Spock picks the model for each task; choosing Seleya’s own model keeps that step on our servers, but web search and page reading still use third-party services. The DPA sub-processor list has every provider, its location and what it keeps.
Our commitments
- No training. Neither Seleya nor its providers use your content to train AI models, unless you ask us in writing to tune a model used only for you. If we break this, you may end your agreement and get back 12 months’ fees.
- Notice of new providers. Customers get 30 days’ notice by email before we add or replace a sub-processor, and may object.
- Incidents. We notify affected customers without undue delay, and within 72 hours at the latest; immediately where POPIA requires it.
- Deletion. Deleted files leave active systems within minutes, other deletion requests are completed within 30 days, and backups expire within 30 days.
- Lawful transfers. Transfers out of South Africa are made under binding agreements that meet section 72(1)(a) of POPIA; GDPR transfers use an approved mechanism.
Retention at AI providers
| Provider | Kept |
|---|---|
| Seleya’s own models | Nothing after the request |
| Fireworks | Nothing after the request |
| OpenAI | Abuse-monitoring logs, up to 30 days |
| Google Gemini (paid) | Prompts for a limited period, for abuse monitoring only |
None of them uses your content for training. Our own diagnostic copies of AI requests are kept for up to 30 days.
Security
Data is encrypted in transit and at rest in our database, file storage and search index storage. Passwords are hashed and connected-account tokens are encrypted. Only team members who need production access have it. Every file read is checked against the workspace’s permissions. Seleya does not yet hold a SOC 2 or ISO 27001 certification. The full list of measures is in DPA Annex C.
Reporting a vulnerability
Email louis@spock.chat, copying support@spock.chat, with a short description and steps to reproduce. Please don’t attach other people’s data or credentials. Our contact details are also in security.txt.
Test only with accounts and data you control. Don’t access other people’s content, keep or share data you come across, disrupt the Service, use social engineering, or test third-party services without their permission. If you follow these rules in good faith, we authorise your testing and will not take legal action over it. We will investigate every report and coordinate disclosure with you. We do not run a paid bounty.
Changes to this page
- 6 October 2026 (version 3.1): rewritten in plain language; locations confirmed for every service; DPA made signable by Enterprise customers.
- 1 October 2026 (version 3.0) and 1 August 2026: earlier versions are in the legal archive.
Contact
Seleya Labs Inc. · support@spock.chat · Privacy and security: Louis-Neil Korsten, louis@spock.chat · Mailing address: 1111B S Governors Ave STE 56751, Dover, DE 19904, USA.