Spice AI security and SOC 2 Type II compliance

Spice AI is SOC 2 Type II compliant. It encrypts customer data in transit and at rest, and it limits access with MFA, RBAC, and just-in-time controls. This page covers the controls Spice AI operates for Spice Cloud and the security features teams configure in the open-source Spice runtime.

Report a vulnerability (opens in a new tab)

Contact us

Security principles at Spice AI

Ten principles govern how Spice AI builds, operates, and audits Spice Cloud and the Spice runtime.

Compliance

SOC 2 Type II compliant, audited by Prescient Assurance under AICPA standards.

Secure access control

Authentication (AuthN), authorization (AuthZ), and role-based access control (RBAC) gate access to internal systems.

Data protection

Secrets and sensitive data are encrypted at rest. Data in transit is encrypted with TLS 1.2 or later.

Multi-factor authentication

All authentication systems require and enforce multi-factor authentication (MFA).

Least privilege

Least privilege access is employed so that users, employees, and contractors do not have greater access beyond what is necessary.

Defense-in-depth

Layered controls protect each system, so no single control is the only safeguard.

Auditable

Access and usage are logged and auditable.

Secure code

Code is scanned and tested for secrets and vulnerabilities.

Code audits

Internal and external experts audit codebases to identify and address vulnerabilities, maintain best practices, and ensure adherence to security standards.

Just-in-time access

Access is granted only when a task requires it and expires automatically.

How security is shared between Spice AI and customers

Spice AI secures the systems it operates, and customers secure the credentials and access policies they control. For Spice Cloud, Spice AI runs access controls, encryption, code scanning, patching, isolated environments, and external audits. Customers manage who can reach their apps and API keys. In self-hosted deployments, teams also configure TLS, authentication, and secret stores in the Spice runtime.

Runtime authentication docs (opens in a new tab)

TLS configuration docs (opens in a new tab)

Security features in the Spice runtime

Teams that self-host the open-source Spice runtime turn on these controls in the runtime and Spicepod configuration.

TLS encryption

TLS encrypts connections to the runtime and reloads rotated certificate files without a restart.

API key authentication

API keys protect the HTTP and Arrow Flight SQL endpoints. Keys can load from a secret store instead of plain text.

Secret stores

Credentials load at runtime from environment variables, Kubernetes, AWS Secrets Manager, Azure Key Vault, the system keyring, or HashiCorp Vault (Enterprise).

Scoped AI sandboxes

AI agents and models query temporary, scoped datasets instead of production databases, and each query is logged.

FAQs

Answers to common questions about Spice AI security, compliance, and runtime configuration.

Yes. Spice AI is SOC 2 Type II compliant under AICPA standards. Prescient Assurance, an independent auditor, audited Spice AI and confirmed SOC 2 Type II compliance in February 2024. Customers on the Spice.ai Enterprise plan can request a copy of the audit report.

Spice AI encrypts sensitive data in transit and at rest. All encrypted connections use TLS 1.2 or later. Service secrets live in platform-specific key vaults, and corporate secrets live in an enterprise password manager behind SSO. Spice AI logs all access to data and limits it with least-privilege and just-in-time (JIT) controls.

Spice AI controls access with SSO, multi-factor authentication (MFA), role-based access control (RBAC), and least-privilege policies. Staff receive access through just-in-time (JIT) workflows only when a task requires it. JIT access expires automatically after a limited time. Spice AI logs, monitors, and audits all access.

Turn on TLS, API key authentication, and a secret store in the Spice runtime. TLS in the Spice runtime encrypts connections with your own certificate. API key authentication protects the HTTP and Arrow Flight SQL endpoints. Spice secret stores load credentials from sources such as Kubernetes, AWS Secrets Manager, and Azure Key Vault.

Spice keeps a copy of data only for datasets with acceleration turned on. The copy holds the whole dataset or a filtered subset, in an accelerator such as in-memory Arrow, DuckDB, SQLite, or Spice Cayenne. For other datasets, Spice queries the source and caches recent results in memory for 1 second by default. SQL federation and acceleration explains both modes.

Spice gives each agent a scoped dataset that holds only the data the agent needs. Secure AI sandboxing keeps agents off production databases and logs each query. The MCP server gateway applies access controls to the tools that models call. The secure AI agents use case shows the full deployment pattern.

Email security@spice.ai to report a vulnerability. The Spice security policy on GitHub lists the supported versions. Security fixes go to the last two minor release series of the latest major version.

See Spice in action

Walk through your use case with an engineer and see how Spice handles federation, acceleration, and AI integration for production workloads.

Talk to an engineer (opens in a new tab)