security

How Spectrum stores and processes data

Spectrum stores configuration on your computer or company servers. Below you can see which data is required to verify the licence and which connections you enable when using the WEBCON database or AI features.

1. What we send during licence verification

During activation, the software connects to the licence server over an encrypted connection: https://licencje.viewer-pro.pl. The software refreshes verification at startup and periodically, usually once a day. Activation and administrator actions may trigger an additional request. The connection transmits the following information:

Data transmittedPurpose
key during activation, licence number during renewallicence identification
hashed installation identifier, without the server name or username in plain textchecking the number of activations assigned to the key
counts of active users, workspaces and environments with snapshots, without nameschecking plan limits
software versionchecking entitlement to the software version

The server returns verification valid for 30 days. Licence requests do not contain workspace, environment, application or process names, logins, server addresses or package contents. The connection's IP address appears in licence server logs. Log retention is described in the privacy policy.

Working without internet access: In offline mode, you verify the licence using a file valid for 12 months, and the software does not contact the licence server. If an online installation loses connectivity, it works until the current verification expires, followed by 14 additional days with a warning. It then switches to read-only mode. Data remains available for viewing. See the offline activation guide.

2. Where configuration is stored

Export packages, environment snapshots, queries, integration addresses and process descriptions are stored on your infrastructure. The licence server does not receive their contents. Apart from the licensing mechanism described here, Spectrum does not send usage analytics to the vendor or check automatically for updates. When you use the assistant or AI descriptions, your questions and the necessary configuration are sent to your chosen model provider, as described below.

3. Connections you enable in settings

The offline licence request file also contains the edition, creation time, installation public key and signature. It does not contain the installation private key. You deliberately provide it as part of activation; it is not an automatic configuration export.

4. What the licence server stores

The server stores order and licence management data: licence number, plan, company name, email address, installation identifiers and the end of the paid period. It also processes the counters and software version described above. It does not store WEBCON configuration. Processing purposes and retention periods are described in the privacy policy.

5. Securing the installation and backups

The installation administrator is responsible for HTTPS, network rules, system and database updates, and least-privilege access. The WEBCON source should use an account with the permissions needed to read configuration. Do not expose Portable access on your computer to the public internet.

Back up the database and secrets according to the edition documentation and test restoration. A database backup alone may not be enough to recover encrypted credentials. Before sending material to support, remove secrets and data not required for the issue; agree access to personal data before sharing it.

6. Reporting vulnerabilities

Send a report to the contact addresswith “security” in the subject. Describe the issue, software version and steps to reproduce it. We respond within two business days. Security fixes are released outside the regular update cycle; with the reporter's consent, we credit them in the changelog.