Trust Center

Welcome to the SpendRule Trust Center

At SpendRule, Inc., our mission is to bring precision, transparency, and automation to the $323 billion spent annually on purchased services, with a primary focus on eliminating waste within health systems. Founded in 2025 and based in Dallas, Texas, we provide an advanced, AI-enabled contract validation and invoice processing platform. By utilizing natural language processing and proprietary machine learning models, our platform automates contract analysis, validates invoices against contract terms, identifies pricing discrepancies in real time, and tracks financial savings to prevent revenue leakage.

Because we handle critical financial and contract data, maintaining the highest standards of security, confidentiality, and processing integrity is foundational to our operations. This Trust Center serves as a transparent, public portal designed to give our customers, partners, and visitors a clear overview of our comprehensive security practices, compliance certifications, and operational safeguards.

---

Our Security-First Philosophy

We operate under a "Security-First" philosophy that guides the development and management of our AI-driven platform. Rather than relying on periodic manual checks, we employ a proactive, data-driven approach to risk management.

• Continuous Compliance Monitoring: We partner with Drata to maintain real-time visibility into our security posture. This automated system allows us to monitor technical risks—such as cloud configurations and access controls—on a daily basis.
• Proactive Risk Management: Our management team regularly reviews automated alerts and compliance reports to ensure our operating environment remains securely within established risk tolerances. We also maintain a formal risk management process to evaluate and resolve identified threats.

---

Key Pillars of Our Trust Program

The Trust Center organizes our security practices into several key areas, which are detailed throughout the rest of this portal:

1. Data Protection & Infrastructure Security

• Cloud Security: Our platform is hosted on Amazon Web Services (AWS), utilizing secure, high-availability data centers that maintain their own rigorous SOC 2 Type II and ISO 27001 certifications.
• Network Defenses: We protect our infrastructure using Virtual Private Clouds (VPCs), web application firewalls (WAFs), and automated DDoS protection.
• Vulnerability Management: We perform continuous vulnerability scans to identify potential weaknesses and remediate them based on risk and impact.

2. Access Control & Identity Management

• Least Privilege & Role-Based Access: We utilize a role-based security architecture. Access to our production environment, AI analysis engine, and customer data repositories is strictly restricted based on job roles. We follow the principle of "Least Privilege" and implement enhanced supervisory monitoring if overlapping responsibilities occur.
• Multi-Factor Authentication (MFA): All users must be uniquely identified and authenticated, and MFA is strictly required to access sensitive systems.
• Asset Ownership: All critical system resources (such as databases and code repositories) are tracked in an active asset inventory with assigned owners who regularly review access permissions.

3. Operational Integrity & Personnel Security

• Security Training & Accountability: All full-time employees and contractors must complete formal security awareness training upon hire and annually thereafter. Training completion is tracked automatically within Drata.
• Code of Conduct & Policies: Every employee must accept our formal Code of Conduct and Acceptable Use Policy upon hire.
• Incident Response: We maintain an established Incident Response Plan to ensure a quick, orderly, and effective response to any security incidents.

---

Our Commitments

Our security and operational commitments are formalized through our Master Service Agreements (MSAs), Service Level Agreements (SLAs), and platform documentation. We also maintain a public Terms of Service that outlines our security and availability commitments. To ensure external accountability, we provide a clear process for external users to report security concerns, incidents, or complaints directly to our team.

We invite you to explore the rest of this Trust Center for detailed documentation, reports, and evidence of our security controls in action.