Security
No badge walls, no vague claims. Here is exactly how Clarion handles your data today — and what is on the roadmap, labelled as roadmap.
In force
Clarion is built around PIPEDA's principles: collect the minimum, use it only for the stated purpose, and keep workspace data under your control. Most of what we ingest is public record; what you add — topics, clients, notes — stays yours.
In force
All traffic is encrypted with TLS, and data is encrypted at rest on the managed cloud infrastructure that runs Clarion. We don't operate our own servers — we build on providers whose physical and network security operates at a scale no early-stage company could match alone.
In force
Every query is scoped to your workspace. Role-based access control separates owners, admins, and members, and an append-only audit log records sensitive actions — entries can be added, never edited or deleted.
In force
Our application tier runs in Canada (Montréal); our primary database is currently hosted in the United States (US-East) on managed Postgres, encrypted in transit and at rest. Most of what we ingest is public record. For the personal data you add, we contractually require comparable protection consistent with PIPEDA's accountability principle, and we provide a transfer-impact assessment and a data processing agreement (DPA) on request. A Canadian-region database is on our roadmap.
On the roadmap
We are not SOC 2 certified today, and we won't pretend otherwise. A Type I audit is planned as the platform grows, and this page will change the day that changes.
In force
Found a vulnerability? We read every report, respond quickly, and credit researchers who help us — no NDA required to tell us something is broken.
security@withclarion.comSecurity questionnaire or procurement requirements? Write to us:
hello@withclarion.com