Account and model access
Spectral uses authenticated access for saved models and agent tools. Passwords and API tokens are stored as hashes. API tokens can be revoked from your profile.
Model links do not replace access checks. Keep tokens private and review the permissions you give to an external agent.
Local and hosted data
Anonymous file conversion runs in the browser. Signed-in imports and MCP workflows send model data to the hosted service. Public connections use HTTPS. See the privacy policy for data handling.
Report a security issue
Use the contact page to reach the maintainer. Do not post tokens, personal data, or confidential model files in a public report. Share sensitive evidence only after a private channel is agreed.