Security questionnaire answers

Our answers to the questions procurement teams ask most, from the same verified facts as the Trust Center. Where something is not in place yet, the answer says so.

Certification and governance

Is the company certified to ISO/IEC 27001 or attested to SOC 2?: No; Clauseloop is not SOC 2 or ISO 27001 certified. The Trust Center lists the controls in place today and the ones that are not yet.
Do you publish the subprocessors that process customer data?: Yes; The Trust Center names each outside service that processes data and what it receives.
Is there a way to report a security vulnerability?: Yes; Email info@swcservices.com. The same contact is published in /.well-known/security.txt.

Hosting and infrastructure

Where is customer data hosted?: Yes; On our own servers at Oracle Cloud Infrastructure in India: the application, its PostgreSQL database and uploaded files. The database runs on those servers, not with an outside database service.
Is a content delivery network or proxy in front of the service?: Yes; Cloudflare answers DNS and serves the site over TLS. It caches only public files; responses that carry a signed-in session are marked not to be cached.
Do you keep a separate staging environment?: Planned; Changes are tested end to end on a throwaway database built for each run; a standing staging environment is planned.

Data protection

Is data encrypted in transit?: Yes; Every connection from the browser uses TLS, and HSTS tells browsers never to connect without it.
Is data encrypted at rest?: Yes; Our servers store data on Oracle Cloud block volumes, which Oracle encrypts at rest with AES-256 by default. Google tokens for connected calendars are encrypted again with AES-256 before they are stored.
Is each customer’s data isolated from other customers?: Yes; PostgreSQL enforces row-level security on every table, and a client portal user reaches only their own organisation’s records.
Do you store payment card data?: No; Clients pay with the payment provider; Clauseloop never sees or stores a full card number.
Can customers export their data?: Partly; Reports export to PDF or Excel from the application. A complete export of everything we hold is done on request.

AI

Is customer data used to train AI models?: No; AI drafting is switched off, and no customer, client or lead data is sent to any AI provider.
Is customer data sent to third-party AI providers?: No; AI is an optional add-on that runs on models we host on our own servers, and it is used only to draft sales and client emails. It is switched off today.

Access control

Is access role-based?: Yes; Admins, consultants, sales associates and finance managers each reach only the pages and records their role needs, and the database enforces the same rules.
Is multi-factor authentication available?: Planned; Two-factor sign-in is not available yet. It is planned.
How do your customers’ clients sign in?: Yes; Client portal users sign in with a one-time link sent to their email address; they have no password to lose.
Is access removed promptly when someone leaves?: Yes; When an admin deactivates a staff account, its sessions end and it can no longer sign in.

Application security

Do you use a Content Security Policy and other security headers?: Yes; Every response carries a Content Security Policy, X-Frame-Options, X-Content-Type-Options, a Referrer-Policy and a Permissions-Policy.
Are state-changing requests protected against CSRF?: Yes; API calls from the application need a CSRF token.
Are endpoints rate-limited?: Yes; Portal sign-in links, password resets, public forms and the API are rate-limited per client IP address, read from Cloudflare so it cannot be spoofed.
Are third-party dependencies checked for known vulnerabilities?: Yes; Every release is checked with npm audit for the application and the automation server; a high or critical finding blocks it.

Logging and monitoring

Are privileged actions logged?: Yes; User and role changes, invoice approvals, payments and settings changes are written to an audit log with who did what and when. The database refuses any change to or deletion of an audit entry.
Are application errors monitored?: Yes; Errors are reported to Sentry, with cookies and authorization headers removed before they are sent.
Is uptime monitored, with alerts and a status page?: Planned; Alerts when the service goes down, and a public status page, are planned.

Continuity and incidents

Are backups tested by restoring them?: Planned; A tested restore of the database is planned. Until it has been done, we do not describe our backups as proven.
Do you have a written incident-response and breach-notification policy?: Planned; It will be published with our data processing agreement.

Privacy

Which analytics run, and where?: Yes; Google Analytics runs on the public website only, never in the application or the client portal. Inside the application, PostHog (EU) records which pages staff open; it sets no cookies.
Can you sign a data processing agreement?: Planned; Our data processing agreement is being prepared, together with the written incident-response policy.