ISO 27001 & SOC 2 Readiness Roadmap

Terms of Service & Privacy Policies

Specora is an applied enterprise platform developed and operated by Bizzteq. Last updated: October 2026.

EU Data Sovereignty & NDA Safeguard: Specora enforces strict multi-tenant boundary isolation. All primary compute and databases are located in Amsterdam (EU-West). Customer architectural models, ERP schemas, BOD payloads, and milestone deliverables are strictly partitioned per practice and are never shared or used to train public foundational AI models.

1. Terms of Service

1.1 Scope & Parties

Specora (“Service”) is operated by Bizzteq (“Provider”, “we”). The platform facilitates structured specification authoring, 4-pillar work breakdown gating, formal steering committee sign-offs, and tenant-isolated semantic retrieval for enterprise IT practices and systems integrators.

1.2 Intellectual Property & Deliverables

You retain exclusive ownership of all specification drafts, ERP schemas, BOD payloads, database designs, architecture decision records (ADRs), and custom brand assets submitted to the Service.
Provider claims no intellectual property rights or licensing claims over customer deliverables or contract work products created within the platform.
Client-facing Word (.docx) and PDF exports belong solely to your organization and its designated client accounts.

1.3 Steering Committee Sign-Offs & Milestone Bundles

Milestone bundles sealed using Specora's sign-off matrices utilize cryptographic SHA-256 seals. You acknowledge that authorized signatures executed by your users or designated external guest signatories constitute formal, non-repudiable delivery gate acceptances within your project lifecycle.

2. Privacy & Data Protection (GDPR)

2.1 Data Processing Roles

For direct account credentials, billing information, and commercial subscription management, Bizzteq acts as a Data Controller. For customer design specifications, uploaded attachments, and client metadata managed inside delivery workspaces, the customer acts as the Data Controller and Bizzteq acts as a Data Processor under the EU General Data Protection Regulation (GDPR).

2.2 European Data Sovereignty & Hosting Location

Specora's primary application servers, databases, and vector stores are hosted exclusively within the European Union in Amsterdam, Netherlands (EU-West). Sensitive project assets and architecture deliverables are not transferred to jurisdictions outside the European Economic Area (EEA) without express customer contractual direction.

3. Security Controls & Compliance Safeguards

Specora is engineered to satisfy SOC 2 Type II (Trust Services Criteria CC6/CC7) and ISO/IEC 27001 (Control A.12) standards:

Cryptographic Audit Sink (ISO 27001 A.12): The platform records state mutations, baseline reviews, steering seals, and authentication attempts in an append-only, SHA-256 chained ledger. Audit logs are tamper-evident and protected against administrative modification or deletion.
Mandatory Multi-Factor Authentication (SOC 2 CC6.1): Enterprise accounts support RFC 6238 Time-Based One-Time Password (TOTP) two-factor authentication with salted, cryptographically hashed single-use emergency recovery keys.
Encryption in Transit & At Rest: All external HTTP communication requires TLS 1.3 encryption with strict HTTP Strict Transport Security (HSTS) headers. Persistent database storage is encrypted at rest using AES-256.
Logical Tenant Boundaries (SOC 2 CC6.3): User sessions are dynamically scoped to verified tenant perimeters to prevent unauthorized cross-practice or cross-client data access.

4. AI Governance & Dexter Copilot Policies

Strict Tenant Vector Isolation: Spec Assistant indexes deliverables exclusively within your isolated tenant boundary. Vectors and embeddings are mathematically partitioned to eliminate cross-tenant data leakage.
Zero Model Training Guarantee: Customer architectural specifications, requirements, and intellectual property are never retained, indexed, or used to fine-tune third-party or shared foundation models.
Local Sovereignty Option: Organizations operating under classified, defense, or banking mandates can utilize sovereign local embeddings (MiniLM) running directly on European infrastructure without external API dependencies.
Transparent Metering: Compute operations and token expenses are tracked with transparent margin visibility under the administration console.

5. Contact, DPA & Legal Notices

To execute an enterprise Data Processing Agreement (DPA) incorporating Standard Contractual Clauses (SCCs), report security inquiries, or request compliance audit assistance:

Operator: Bizzteq
Platform: Specora (specora.bizzteq.com)
Web: bizzteq.com
Email: info@bizzteq.com
Headquarters & Jurisdiction: Espoo, Finland