Security

How the data is protected

Nothing is shared until the person grants it, and nothing leaves the place where it is kept. Here is how that is built.

Encrypted in transit and at rest
Hosted on AWS, on a private network
Consent log kept for two years
Processor under the UAE PDPL

Security

Six things that hold

Revocable consent
Nothing is shared until the person grants it. A grant covers one sphere for one company, and the person can end it in a single step — the company stops being served the contacts immediately.
Revoking ends access at the source. It does not reach anything a company has already exported elsewhere, and Spherum does not claim otherwise.
Access does not resume on its own. The company invites again, and the person grants again.
Token security
A token carries two values that do nothing alike. The printed ID identifies the token so a person can claim it — it opens no one's contacts. The QR carries a separate key, and that key is what resolves to the emergency view. An owner can also ask for the last 5 characters of the printed ID before the view opens, so the QR alone is not enough.
Spherum stores only a hash of that key. It exists on the printed token and nowhere else, so it cannot be looked up, listed, or reissued — a lost token is deactivated, not recovered.
The scan page is unlisted, rate-limited, and returns nothing for a key it does not recognise. A scan is answered with a temporary address that holds no key and stops working after 30 minutes; after that, the token has to be scanned again.
Audit trail
Spherum records every action that carries consent — a grant given, a grant revoked, a token issued, bound, released, switched off, or scanned. Entries are written once and never edited or deleted, and are kept for two years.
The record holds identifiers, timestamps and what happened. It does not hold contact details, and it does not identify anyone who scans a token. The same boundary applies to our operational logs — contact details are masked before they are written.
Where the data lives
Spherum runs on AWS. Application services sit in a private network with no public address of their own; traffic reaches them only through a load balancer, over TLS.
The database is managed MongoDB Atlas. It is encrypted at rest, reachable only from a fixed set of allowed addresses, and connected to the application over a private link rather than the open internet. Administrative access goes through a VPN — there is no path to the data from a laptop on the internet.
Credentials are held in a managed secret store and never in code or configuration. Deployments run without long-lived access keys.
Sign-in and keys
People sign in with a one-time code sent to their own email address or WhatsApp number. There is no password to steal or to reuse.
Team members sign in with a second factor. API keys are shown once, stored as a hash, and revoked in one click — a revoked key stops working immediately and stays in the list as a record that it existed.
Retention
When a person revokes a grant, the values the company could see are cleared after 30 days. The consent record stays, so there is always proof of what was granted and when.
When a company archives a person, the same clock runs for 90 days. A record nobody has touched for 24 months is removed, after a notice to its owner that they can answer with one click.

Built to the UAE PDPL

Each line is a requirement of the law, and beside it, where the product meets it.

Lawful, revocable consent: Nothing is shared until the person grants it, and the person can revoke in one step.
Proof of consent: Every grant and revocation is recorded in a log that is written once and never edited.
Data minimisation: A company sees only the fields its own template defines.
Separation between companies: Data granted to one company is never visible to another.
Storage limitation: Records are kept to a defined retention period, then removed.
Accuracy: One record, updated by the person — every live grant reflects the change at once.
Security of processing: Encrypted in transit and at rest, on a private network, with administrative access through a VPN.
Confidentiality of logs: Contact details are masked before anything is written to our operational records.
Transparency: The person sees every grant they hold and who holds it.

Spherum acts as a processor for the contact data held in your spheres. We provide a data processing agreement, a published list of sub-processors, and support for access, correction and deletion requests from the people whose data you hold.

Data processing agreement Privacy notice Terms of service

Questions about how your data is handled? contact@spherum.ae

Product