Security

1. Scope

This policy covers the systems Sandspit runs:

• The Sandspit add-in for Microsoft Excel
• The Sandspit API and web application
• sandspit.app and its subdomains

Procore itself is out of scope. Sandspit connects to Procore through its public REST API on behalf of a signed-in user. Report issues in Procore's own products to Procore.

Also out of scope: denial-of-service and load testing, social engineering of our team or customers, physical attacks, spam or phishing, and reports produced by an automated scanner with no demonstrated impact.

2. What we ask

• Use your own account and test data. Never access, modify, or store another customer's data.
• Stop as soon as you have confirmed a vulnerability. Take only what you need to show it is real.
• Do not run attacks that degrade the service for other people.
• Give us a reasonable window to fix the issue before you publish.

3. Safe harbor

If you research in good faith and follow this policy, we will treat your work as authorized. We will not pursue legal action against you, and we will say so if a third party asks. If a report accidentally exposes customer data, tell us and delete your copy. A mistake made in good faith stays covered.

Sandspit does not run a paid bug bounty. We credit researchers who want it.

4. How we respond

• Acknowledge: within 2 business days.
• Assess: within 5 business days, with a severity and a plan.
• Resolve or mitigate: within 90 days, sooner for anything that exposes customer data.
• Notify: affected customers, and Procore's partner team where Procore data is involved, on a confirmed incident.

5. How Sandspit handles your data

Data pulled from Procore lands in your own Excel workbook, not on our servers. What Sandspit stores is limited to your identity, your encrypted Procore tokens, the companies and projects you connect, rows you stage for an import, and audit records of what was written to Procore.

• Authentication: OAuth 2.0 Authorization Code, per user. No service account. Sandspit can only do what your Procore permissions allow.
• Encryption: AES-256 at rest, with OAuth tokens encrypted again at the application layer. TLS 1.2 or higher in transit.
• Retention: uploaded source documents are deleted 24 hours after an import completes, with a 7-day cap. Staged rows, sync summaries, and the request audit log are kept for 90 days. Sessions are kept for 30 days.
• Deletion: email [email protected] or [email protected] to request deletion. We confirm within 2 business days and complete within 30 days.
• AI: the only AI in the product extracts line items from documents you upload. Procore data is never used to train or fine-tune a model.

Our subprocessors and the personal data we handle are listed in the Privacy Policy.

6. Practices

• Multi-factor authentication on every account that can reach production.
• Dependency, secret, and static analysis scanning on every change and weekly against unchanged code.
• Quarterly review of who holds production access.
• Audit records of every write to Procore, by user, project, and module.

SOC 2 Type I is in progress, targeted for Q4 2026 to Q1 2027, with the Procore integration in scope. A third-party penetration test is part of that work.

7. Contact

Security: [email protected]
Support: [email protected]
Machine-readable version of this policy: /.well-known/security.txt