Security & data handling
How your data is kept apart from everyone else's, who can see it, what we log, and the honest list of what we have not built yet.
Applies to klaritiq.in and the KlaritiQ platform
- Every request is checked against your organisation before any data is read. One organisation cannot see another's rows.
- Every change is written to an audit log that is never edited. Deleting governance records needs a second approver.
- KlaritiQ staff cannot open your workspace unless you switch on time-boxed support access, which is itself logged.
- Sessions expire after 2 hours idle and 7 days at most; sensitive actions need a sign-in from the last 15 minutes.
- Not yet: two-factor authentication, India hosting for the database, an external security audit.
The shape of the system
The application and database run on Render in the United States; uploaded files sit in a Cloudflare R2 bucket in the Asia-Pacific region. The case engine that runs assessments is a second service on the same database; it refuses any request that does not carry a server-to-server key, and that key is never sent to a browser. Two administrative operations, erasing a transcript and reading the authoring queue, need a second, separate key that the public-facing server deliberately does not hold, so they cannot be triggered from the web at all. Erasing a case when you delete it needs a third key that opens erasure and nothing else; the server holds it for its deletion jobs, and it is never sent to a browser.
Keeping organisations apart
| Control | What it means for you |
|---|---|
| Tenant scoping on every request | Before a route touches data it confirms you are an active member of the organisation in the URL and loads only that organisation's rows. There is no "all organisations" query in the product. |
| Roles | Owner, admin, member and light. Owners can delete or transfer the organisation; admins manage members and settings; members work; light members see less. |
| Department scoping | An organisation can restrict a member to their own department's records. |
| Benchmarks without leakage | Peer comparisons use only aggregate functions (count, average, percentiles) across a group of at least several organisations, so no single organisation's numbers can be recovered. |
Accountability
| Control | What it means for you |
|---|---|
| Immutable audit log | Every state change, every sign-in, every deletion request is appended with who, what and when. Nothing in the product edits or deletes an entry while the organisation exists. Owners can export it. |
| Second-approver deletion | Deleting evidence, initiatives, risks or decisions creates a request that another admin must approve. An owner or admin can self-approve, and the log says so. |
| Support access, opt-in | KlaritiQ staff have no standing access to workspaces. An owner or admin can grant support access for a set number of hours, with a reason; the grant, its expiry and anything done under it are logged. |
| Platform admin, minimal | Our own admin console is limited to site content, subscribers, leads and the regulatory review queue. It does not browse organisation workspaces. |
Accounts and sessions
| Control | Detail |
|---|---|
| Passwords | Stored as salted hashes; we never see or store the password itself. Password-less sign-in links expire in 5 minutes and work once. |
| Sessions | 2 hours of inactivity ends a session; 7 days ends it regardless. Deleting an organisation, transferring ownership, removing a member or deleting your account requires a sign-in from the last 15 minutes. |
| Google sign-in | Optional. We store the identity Google gives us; we hold no Google credentials. |
| Single sign-on | Per-organisation SAML/OIDC registration exists in the data model and is being wired up for enterprise customers; it is not self-serve yet. |
| API keys | Shown once at creation; only a SHA-256 hash is stored. Keys are organisation-scoped. |
| Rate limits | Public forms and account endpoints are rate-limited per IP. |
AI assistants
If an owner turns it on, a person can connect an AI assistant to read their organisation's record. These are the controls around it.
| Control | Detail |
|---|---|
| Off by default | Nothing is reachable until an owner of the organisation turns it on, and an owner can turn it off at any time. |
| Acts as the person | The assistant signs in as one person through KlaritiQ's own sign-in and consent screen. There is no shared service credential. |
| Read only | Every tool is read only. An automated test fails if a tool could write, sign off, or record evidence. |
| Checked on every request | Who the person is, their membership, their role, their department limits and the organisation's switch are looked up again on each request. Removing a person or turning the switch off stops the assistant on its next request. |
| Bound to KlaritiQ | The access token is issued for KlaritiQ's assistant endpoint only and is refused anywhere else, and a token made for another service is refused here. |
| Stoppable | An owner can stop one person's one assistant in their organisation without affecting anything else. |
| Recorded | Each request is recorded: who, which assistant, which tool, how many rows, how it ended. The answer an assistant was shown is never stored, and a search is recorded by its length only. |
| Untrusted text | Text written by people or taken from documents is length-capped and flagged as data, so a hostile document cannot instruct an assistant. |
| Limits | 600 requests an hour per person, and a request that comes from a web page is refused. |
What an assistant reads is sent to its provider, which is the provider you chose and not a KlaritiQ sub-processor. See Sub-processors.
DPDPA assessments: hosting and transfer
DPDPA assessments, including the documents you upload to them, are stored in our database on Render in Oregon, United States. They are not kept in the file bucket described below.
Our counsel's transfer position for this hosting has not been recorded yet. Its reference and date will appear here once it is signed. Until then, the sign-up screen for a DPDPA assessment states where the data is hosted.
Documents you upload
Files are checked against their declared type before they are accepted (a PDF must actually be a PDF), limited in size, and stored under an opaque key. Their text is sent to Claude to propose facts; the proposal sits on the document until a person confirms or rejects it. Raw files are not retained by default: an organisation switches file retention on, sets an expiry (365 days unless changed) and a storage cap, and files past expiry are deleted by a daily job while the confirmed facts remain.
Encryption, backups, logs
| Where | What is in place |
|---|---|
| In transit | HTTPS everywhere between your browser and us, and between our services and Render, Cloudflare, Anthropic, Resend, Google, HubSpot, Atlassian and Slack. |
| At rest | Render's managed Postgres and Cloudflare R2 both encrypt stored data at rest. We do not add a second layer of application-level encryption to stored records today. The exception is the long-lived Google Calendar, Jira and Confluence refresh tokens and the Slack bot token, which are encrypted with AES-256-GCM before they are stored. |
| Backups | Render takes automated database backups. An erased record can survive in those backups for the provider's retention window before it ages out; we do not restore backups except to recover from an outage. |
| Logs | Application logs hold request paths, user ids and error details, not document contents or assessment answers. IP addresses appear in the assessment turn log, the consent record and the admin action log for evidentiary reasons, and are removed when the account is erased. |
| Secrets | API keys for Anthropic, Resend, Google, HubSpot, Atlassian and Slack live in the hosting environment, never in the code repository. |
| Slack permissions | If an administrator connects Slack, KlaritiQ asks Slack only for: posting messages, listing channels (and the private channels it has been invited to), joining the one public channel an administrator picks, and the /klaritiq slash command. It also reads a Slack person's name, so a saved note can say who wrote it. It does not ask to read message history or to subscribe to messages. The only message it receives is one an administrator deliberately saves with the Save to KlaritiQ shortcut, which is kept as an unverified evidence note. Every request Slack sends is checked against Slack's signature and refused if it is older than five minutes. A command or shortcut runs only as a person who has linked their own Slack account, with that person's KlaritiQ permissions, and never records a sign-off, completes a task or resolves a risk. |
What we do not have yet
We would rather you read this here than discover it later.
| Missing | Status |
|---|---|
| Two-factor authentication | Not built. Google sign-in with 2FA on the Google side is the workaround today. |
| Hosting in India | Not offered by default. Available as a scoped arrangement agreed in writing before regulated data is uploaded. |
| Independent security audit or certification (SOC 2, ISO 27001) | None yet. We are a founder-run company pre-incorporation; we will pursue these when customers require them. |
| Security headers beyond the defaults | A hardening pass (strict transport security, content security policy) is on the list. |
If something goes wrong
If we discover a breach affecting personal data we will contain it, tell affected account holders what happened and what to do, and notify the Data Protection Board of India within the timelines the DPDP Rules set. If you find a vulnerability, please write to hello@getklaritiq.com with "Security" in the subject; we will not take action against good-faith research that respects other users' data.
Related
Privacy Notice · Retention & deletion · How AI is used · Data processing terms
Questions about anything on this page: hello@getklaritiq.com. We write these pages ourselves, in plain language, to match what the product actually does; they are not a substitute for legal advice to you.
Questions about this page?
Write to the KlaritiQ team about anything on it, including privacy requests and complaints.
Email the support team