We pride ourselves on having best in class compliance features.
And you'll never be charged a dime for them.
SpreadSpace's compliance bundle is free of charge on every tier and always will be.
PII Access Log
Every user/API Key action that involves PII is retained in the PII Access Log for up to 7 years, on every plan. The last 90 days are live in the app; the full history exports through the API or directly from our UI.
| User | Role | Event | Borrower | Loan | PII Severity | Timestamp |
|---|---|---|---|---|---|---|
| Matt Donovan | Underwriter | Viewed 1120S | Cedar Valley Foods | SBA 7(a) Working Capital | High | Mar 9th, 4:21 PM |
| Matt Donovan | Underwriter | Downloaded 1120S | Riverbend Manufacturing, LLC | Equipment Term Loan | High | Mar 6th, 11:02 AM |
| Matt Donovan | Underwriter | Viewed 1040 | Atlas Welding Co. | Revolving Line of Credit | High | Mar 3rd, 2:47 PM |
| Matt Donovan | Underwriter | Viewed bank statement | Cedar Valley Foods | SBA 7(a) Working Capital | Medium | Mar 2nd, 9:33 AM |
| Matt Donovan | Underwriter | Downloaded bank statement | Atlas Welding Co. | Revolving Line of Credit | Medium | Feb 28th, 5:14 PM |
| Matt Donovan | Underwriter | Viewed bank statement | Riverbend Manufacturing, LLC | Equipment Term Loan | Medium | Feb 28th, 10:08 AM |
Locked, and kept
PII access locks
Heavy-PII documents are access-controlled. Cross-loan visibility requires a time-bounded borrower-audit claim, and every claim is itself written to this log. Reaching sensitive content is a deliberate, recorded action.
The same retention on every plan
The last 90 days of every log are live in the app, every row. The full history, up to 7 years, exports as CSV from the same tab. Every plan gets the same window and the same history; nothing is staggered by tier.
Immutable retention
Activity history can be retained immutably for up to 7 years, available to every customer on request and held in an append-only log.