Legal
Security
Version 1.0 · Last updated August 21, 2026
How Clarity's architecture, access controls, and incident response protect customer data — the one-pager buyers attach to a vendor review.
Architecture
Browser → application (Render) → Postgres (Render) → Anthropic API. The Anthropic API key is held server-side only and never reaches the browser or client bundle.
Controls
- Access gate with hashed credentials and signed, httpOnly session cookies (14-day TTL)
- Role separation between customer workspaces
- TLS in transit; provider-managed encryption at rest (Render, Supabase)
- Bundle secret scan as a release gate — no API keys ship in client-side code
- Stub / zero-send mode for testing without touching live customer data
- Per-run hard delete with cascade to derived annotations
- Full dataset export available to workspace admins on demand
- Provenance recorded on every run and annotation
Certifications
Clarity does not hold SOC 2 or ISO certification today. Our infrastructure and AI sub-processors do — see certification links per vendor at /sub-processors.
Vulnerability disclosure
Found a security issue? Email [email protected] with details and reproduction steps. We'll acknowledge within 2 business days.
Incident response
If we confirm a security incident affecting your data, we notify you within 72 hours of confirmation with what happened, what data was involved, and what we're doing about it.
Related: /privacy · /sub-processors