Security and trust at Clauseloop
Certification work runs on sensitive client and audit data. This page says where that data lives, what protects it today, what is not in place yet, and who else processes it. Each statement is backed by evidence in our claims register, and we update the page when something changes.
For procurement: security overview (PDF) · security questionnaire answers · answers as CSV
Where your data lives
The whole application runs on servers we operate. Two outside services sit on its edges.
- Our own servers, in India
- Clauseloop runs on our own servers at Oracle Cloud Infrastructure in India: the application, its PostgreSQL database and every uploaded file. The database runs Supabase's open-source software on those servers, so no outside database service holds your records.
- Cloudflare in front
- Cloudflare answers DNS and serves the site to your browser over TLS. It caches only public files such as scripts and images; every response that carries a signed-in session is marked not to be cached.
- The emails the application sends, such as portal sign-in links, invoices and reminders, go out through Resend.
In place today
Each of these can be shown, in the code or on the live service.
- Encryption in transit
- Every connection from your browser is encrypted with TLS, and HSTS tells browsers never to connect without it.
- Encryption at rest
- Our servers store data on Oracle Cloud block volumes, which Oracle encrypts at rest with AES-256 by default. Google tokens for connected calendars are also encrypted with AES-256 before they are stored.
- Access rules in the database
- PostgreSQL enforces row-level security on every table, with rules for each role, so access is enforced by the database and not only by the application.
- Roles, and clients kept apart
- Admins, consultants, sales associates and finance managers each reach only the pages and records their role needs. A client portal user reaches only their own organisation’s projects, documents and invoices.
- Deactivated accounts are cut off
- When an admin deactivates a staff account, its sessions end and it can no longer sign in.
- Audit log
- Privileged actions, such as user and role changes, invoice approvals, payments and settings changes, are written to an audit log with who did what and when.
- Application hardening
- Every response carries a Content Security Policy, X-Frame-Options, X-Content-Type-Options, a Referrer-Policy and a Permissions-Policy. API calls from the app need a CSRF token, and sensitive endpoints are rate-limited.
- Error reports
- Application errors are reported to Sentry, with cookies and authorization headers removed before they are sent.
- No card numbers
- Card payments are made with the payment provider. Clauseloop never sees or stores a full card number.
Not in place yet
Stated plainly, so nobody relies on something that is not there. Each moves to the list above when it is done.
- Two-factor sign-in
- Two-factor sign-in is not available yet. It is planned.
- Backups proven by a restore test
- A tested restore of the database is planned. Until it has been done, we do not describe our backups as proven.
- Uptime monitoring and a status page
- Alerts when the service goes down, and a public status page, are planned.
- A separate staging environment
- Changes are tested on a throwaway copy built for each test run; a standing staging environment is planned.
- A written incident-response policy
- A written incident-response and breach-notification policy will be published with our data processing agreement.
- Certification of SWC itself
- Clauseloop is not SOC 2 or ISO 27001 certified.
AI and your data
AI drafting is switched off. No customer, client or lead data is sent to any AI provider.
AI will come back only as an optional, paid add-on that is off unless you ask for it. When it is on, it runs on models we host on our own servers, so nothing leaves our infrastructure, and it is used only to draft sales and client emails. Audit work, reports and documents never go to it.
Subprocessors
The outside services that process data for Clauseloop, and what each one receives.
| Provider | What it does | Data it receives |
|---|---|---|
| Oracle Cloud Infrastructure (India) | Hosts the application, its database and uploaded files | Everything stored in the application |
| Cloudflare | DNS, TLS and delivery of public files | Request details such as IP addresses |
| Resend | Sends the application’s emails | Recipient addresses and email content |
| Analytics on the public website; Calendar and Search Console only if you connect them | Page views on the public website; the calendar events and search data you connect | |
| PostHog (EU) | Product analytics in the application | The pages staff open, with their user ID |
| Sentry | Error reports | Error details, with cookies and authorization headers removed |
| Stripe, PayPal and Cashfree | Payments, only if you connect them | Payment confirmations that carry the invoice number |
How we handle personal data is in our Privacy Policy, and the cookies we set are in our Cookie Policy.
Report a vulnerability
If you find a security problem in Clauseloop, email info@swcservices.com with what you found and the steps to reproduce it.
Test only with an account of your own. Do not open, change or delete other people’s data, and do not slow the service down. We will reply to your report and tell you when the problem is fixed.
The same contact is published for tools at /.well-known/security.txt.
Trust and security FAQ
Where is my data stored?
On our own servers at Oracle Cloud Infrastructure in India: the application, its database and uploaded files.
How is access to my data controlled?
PostgreSQL enforces row-level security on every table, with rules for each role. Client portal users reach only their own records, and roles limit what each staff member sees.
Is Clauseloop data encrypted?
Yes, in transit with TLS enforced by HSTS, and at rest on Oracle Cloud block volumes encrypted with AES-256. Google tokens are encrypted again with AES-256 before they are stored.
Is my data used to train AI?
No. AI drafting is switched off, and no customer, client or lead data is sent to any AI provider.
Is Clauseloop SOC 2 or ISO 27001 certified?
No. Clauseloop is not SOC 2 or ISO 27001 certified. This page lists the controls in place today and the ones that are not yet.
Do you store card details?
No. Clients pay with the payment provider, and Clauseloop never sees or stores a full card number.
How do I report a security problem?
Email the address under Report a vulnerability on this page, with what you found and how to reproduce it. The same contact is in /.well-known/security.txt.
Ask us about security
Send us your security questionnaire, or ask about any control on this page.