Security
How Clarion protects your data.
Here is what is in force today, and what is still on the roadmap.
What we do, and what is planned
In force
Designed around PIPEDA
We collect as little personal information as we can and use it only for the reason we gave. What you add, like topics, clients and notes, stays yours.
In force
Encrypted in transit and at rest
All traffic uses TLS, and data is encrypted at rest by the managed cloud services that run Clarion.
In force
Strict security headers
Each response sends HSTS, an enforced Content-Security-Policy and the usual framing, referrer and permissions headers, on this site and in the app.
In force
Each workspace is kept apart
Each query is limited to your own workspace. Roles separate owners, members and read-only client seats, and an audit log records sensitive actions.
In force
Where your data is stored
The app and its main database run in the United States (US-East). Our other service providers may be in the United States, Canada or elsewhere, and receive only what they need. For the personal data you add, we require comparable protection by contract, and we share a transfer assessment and a data processing agreement on request.
On the roadmap
A Canadian region
Moving the app and its main database to Canada is on the roadmap. Until it happens, this page will keep saying US-East.
On the roadmap
A SOC 2 Type I audit
We are not SOC 2 certified. A Type I audit is planned, and this page will change when it is done.
In force
Report a vulnerability
Email us. We read each report, credit the researchers who help, and never ask for an NDA first.
Send us your security questionnaire.
Write to hello@withclarion.com for a security review, a questionnaire or a data processing agreement.