Spellbook procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “ (a) Spellbook maintains industry standard administrative, technical, and physical safeguards to protect all Customer Data (including Personal Data) processed, stored, collected or transmitted by Spellbook. Spellbook maintains a data security trust center available at https://trust.spellbook.com/ , which (i) sets out all of Spellbook's data security protocols, (ii) provides information on the data processing commitments of the LLMs used by Spellbook, and (iii) provides a list of Spellbook's data subprocessors and related processing purposes. As between Spellbook and the Customer, Spellbook maintains legal responsibility for the data processing activities of its Affiliates and subprocessors respecting the Services.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ (e) Spellbook complies with all Privacy/Security Laws that are applicable specifically to Spellbook, the Services, this Agreement, and generally to data processors in the jurisdictions in which Spellbook does business.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ (iii) Zero Data Retention by Third Party LLMs. Customer Data transmitted to Third Party LLMs via the Spellbook AI Platform will be processed in real-time solely for the purpose of generating the requested Output. Accordingly, Spellbook will maintain agreements with all Third Party LLMs prohibiting them from storing or retaining any Customer Data (including Inputs, Document Data, or any other transmitted information) beyond the time necessary to generate and return Output to Spellbook.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ (iv) Quality Assurance Monitoring. Spellbook may monitor and temporarily retain Inputs and corresponding Outputs processed through the Spellbook AI Platform (" QA Data ") for the sole purpose of identifying Output quality issues, evaluating prompt and system improvements, and diagnosing technical support matters (collectively, " Quality Assurance "). QA Data will be: (A) retained for no longer than 90 days from the date of collection, then permanently deleted; (B) accessible only to authorized Spellbook personnel on an as-needed basis, who are bound by confidentiality obligations consistent with Article 7; (C) treated as Confidential Information and, where applicable, handled in accordance with section 4.1(d) below respecting Privileged Information; and (D) not used for any purpose other than Quality Assurance.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ (i) Data Transmission and Retrieval. Spellbook will transmit Customer Data (particularly Document Data and User input prompts) to its Third Party LLMs in order to generate Output, and will retrieve Output from the Third Party LLMs to provide to the Customer; all such transmitted and retrieved Customer Data will be encrypted in transit according to industry standard encryption protocols.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ (ii) Data Protection by Third Party LLMs. Spellbook will only transmit Customer Data to Third Party LLMs as required to perform the Services. In each case, Spellbook has executed a data processing agreement with the applicable Third Party LLMs to ensure they are responsible for processing Customer Data in compliance with Privacy/Security Laws.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ (b) Data Processing by Third Party LLMs. Customer understands, acknowledges, and consents to the following:” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “Customer authorizes Spellbook to process Customer Data as required to provide the Services, including (i) sending Document Data to Third Party LLMs to generate Output, and (ii) processing Customer Data through its Affiliates and authorized data subprocessors (identified in Spellbook's trust center, as updated from time to time) solely to provide the Services, as further set out below. Except as expressly permitted in this Agreement, in no event will Spellbook share Customer Data with other Spellbook customers or third parties.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ (d) Notwithstanding anything else in this Article 4, Spellbook may be compelled to disclose Customer Data as required by applicable law or by proper legal or governmental authority. In such cases, Spellbook will give Customer prompt notice of the legal or governmental demand/order for disclosure, and reasonably cooperate with Customer in any effort to seek a protective order or otherwise to contest such required disclosure.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ (c) As part of administering the Customer's account, Spellbook may disclose Personal Data to certain subprocessors when necessary, and these subprocessors (and their purposes) are identified in Spellbook's data security trust center at https://trust.spellbook.com/subprocessors .” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ (a) Generally. Customer authorizes Spellbook to process Customer Data as required to provide the Services, including (i) sending Document Data to Third Party LLMs to generate Output, and (ii) processing Customer Data through its Affiliates and authorized data subprocessors (identified in Spellbook's trust center, as updated from time to time) solely to provide the Services, as further set out below. Except as expressly permitted in this Agreement, in no event will Spellbook share Customer Data with other Spellbook customers or third parties.” | Captured 2026-06-07Open source →Finding permalink → |
| Tier differences | All applicable tiers | low | “ (c) For Users granted an academic license key to the Spellbook AI Platform by Spellbook, the Academic Terms of Use will apply to govern such User's access and use of the Spellbook AI Platform.” | Captured 2026-06-07Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ (a) Beta Features offered initially at no charge to the Customer may be subject to additional fees or charges upon the expiration of any free period term set forth in an applicable Order (or, if there is no stipulated period term in an Order for such Beta Features, upon 15 days' notice);” | Captured 2026-06-07Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.