You give us the keys to your clients. We treat that seriously.
An MSP platform holds access to every client it serves. Spectrum is designed on the assumption that this access is the most valuable thing an attacker could take, and that an AI operator must be held to a higher standard than a person, not a lower one.
Client isolation
Records are separated by the database for every client, so isolation does not depend on every line of application code being right.
Identity through Microsoft
Sign-in uses Microsoft Entra ID with your organization's own policies, including multi-factor sign-in. Only enrolled organizations get in.
Secrets stay secret
Credentials live in a vault. They are not displayed, not typed into forms, and not passed to any AI model.
Least privilege
Spectrum asks for read access where reading is enough, and checks what it holds before it acts. Missing access is reported, never guessed around.
Permanent audit trail
Notable actions by people and by RAY are recorded permanently, with who did what, when, and on whose authority.
Active tests need permission
Anything that probes a client's systems, such as a port scan, requires authorization for that specific test and leaves a permanent record.
A signed agent with sealed local data.
The Spectrum agent is code-signed, updates itself from published releases, and seals the data it keeps on each machine so that only Spectrum can read it.
- Signed installersEvery agent release is code-signed before it is published.
- Sealed on the deviceData held locally is encrypted so another program on the machine cannot read it.
- An allow-list of actionsThe agent runs only the commands it has been built to accept, and reviewed scripts.
- Keys looked after by the systemKeys are managed by Spectrum and its agents, not left with individuals to hold.
RAY is held to a stricter standard than a person.
RAY acts only through the same screens and approvals as your team, every action is booked to a call, and autonomy is earned per capability on a public record.
- Propose, then approveA person approves plans until a capability has proven itself, and handing over more is a deliberate switch per client.
- Automatic demotionA confirmed side effect drops the capability a rung everywhere, immediately.
- Rehearsed before releaseNew capabilities run on the MSP's own machines before any client's.
- Plain recordsWhat RAY did and why is written in plain language that any engineer, or client, can read.
Found a weakness? Tell us first.
If you believe you have found a security issue in Spectrum or on this website, please email [email protected].
- Include what you found, how to reproduce it and the impact you believe it has.
- Please do not access, change or delete data that is not yours, and do not run tests that degrade service.
- Give us reasonable time to fix the issue before you share it publicly.
- We will acknowledge your report within two business days and keep you informed until it is resolved.
- We will not pursue action against research done in good faith within these guidelines.
Need the detail for your risk review?
Ask for our security overview and we will walk your team through it.