We pride ourselves on having best in class compliance features.
And you'll never be charged a dime for them.
SpreadSpace's compliance bundle is free of charge on every tier and always will be.
API Event Log
Machine access is governed and logged like everything else. Key lifecycle and security events stream into a live, environment-scoped feed that feeds Compliance export. Worked example with synthetic data, matching the product columns.
| Time | Event | Resource | Source | Mode |
|---|---|---|---|---|
| 14:02:11 | api_key.created | ss_live_a3f9… | Aisha Reyes · 203.0.113.24 | LIVE |
| 14:06:48 | api_key.first_used | ss_live_a3f9… | service · 203.0.113.24 | LIVE |
| 02:14:55 | api_key.compromised | ss_live_a3f9… | system · anomaly engine | LIVE |
| 02:15:03 | api_key.revoked | ss_live_a3f9… | system · auto-revoke | LIVE |
| 09:48:20 | api_key.rotated | ss_live_b7c2… | Marcus Osei · 203.0.113.51 | LIVE |
| 11:30:12 | api_key.first_used | ss_test_4d10… | service · 198.51.100.7 | TEST |
Illustrative rows. Key prefixes, IPs, and actors are synthetic. The api_key.compromised row shows anomaly detection auto-revoking a key.
API key anomaly detection
Unusual usage on a key is flagged within about five minutes and can auto-revoke. A leaked or runaway key is caught fast, before it becomes a surprise on the bill.
HMAC-signed webhooks
Every webhook carries a signature computed from a per-endpoint signing secret. Verify it on receipt to prove the payload came from us and was not altered in transit.
Idempotency keys
Send an idempotency key with any write and a safe retry returns the original result instead of double-processing. Network blips never create duplicate work.