Security & Data Protection

Data Handling Practices

What We Store

• Claims, properties, and client data (scoped to your organization)
• Photos and documents (Supabase encrypted storage)
• AI-generated reports and artifacts
• Activity logs (for debugging and analytics)

What We Don't Store

• Credit card numbers (processed by Stripe, PCI DSS Level 1)
• Plaintext passwords (hashed by Clerk)
• Unnecessary personal information

Third-Party Services

We rely on industry-leading security providers:

• Clerk: Authentication & user management (SOC 2 Type II certified)
• Supabase: PostgreSQL database & file storage (ISO 27001 certified)
• Stripe: Payment processing (PCI DSS Level 1)
• OpenAI: AI model processing (enterprise-grade security)
• Vercel: Hosting & deployment (SOC 2 certified)

Monitoring & Incident Response

• Real-time Monitoring: Sentry error tracking, uptime monitors
• Automated Backups: Daily database snapshots, 30-day retention
• Incident Response: 24-hour notification for security incidents
• Regular Audits: Quarterly security reviews and penetration testing

Compliance

• GDPR Ready: Data portability, right to deletion, data processing agreements
• CCPA Compliant: California consumer privacy protections
• HIPAA Considerations: Not currently HIPAA compliant (medical data not supported)

Report a Security Issue

If you discover a security vulnerability, please email us immediately at support@clearskaitechnologies.com. We take all reports seriously and respond within 24 hours.

Please do not publicly disclose security issues until we've had a chance to address them. We appreciate responsible disclosure.

Questions?

For more information about our security practices, contact us at support@clearskaitechnologies.com or visit our support page.