Security Policy
Our commitment to protecting your data
At ClauseOne, we take data security very seriously. From system design to daily operations, security is embedded in everything we do. We are committed to maintaining the confidentiality, integrity, and availability of our customers' data while enabling safe and effective collaboration, querying, and analysis.
Security Commitment
ClauseOne operates on industry-recognized security and privacy standards, helping customers across sectors meet their data protection and compliance needs within U.S. regulatory frameworks.
ClauseOne has established a security-first culture that begins at employee onboarding. All employees are required to participate in data security training and adhere to internal policies designed to protect customer data and maintain compliance with independent third-party security assessments.
Security Measures
Data Protection
Encryption & Data Protection
ClauseOne uses Google Cloud Platform (GCP) for all data storage and processing needs. We apply AES-256 encryption for data at rest (e.g., stored credentials, cached query results) and TLS v1.2 or higher for data in transit (e.g., browser traffic, API calls, internal services).
For more information on how we manage and process your data, please visit our Privacy Policy.
Data Handling Philosophy
ClauseOne is designed to minimize data movement and reduce data exposure. Your data is accessed in real-time through live queries, and results are ephemeral unless explicitly cached. This ensures data remains short-lived in memory, lowering risk from data persistence.
Access Controls
Internal Access Controls
ClauseOne follows the principle of least privilege: access to customer data is strictly limited to authorized personnel and only granted when necessary to resolve customer-reported issues. All access to customer data is logged and monitored.
Access to production environments is managed through centralized identity systems with multi-factor authentication (MFA), single sign-on (SSO), and peer-reviewed change control processes. Infrastructure and identity configurations are managed via infrastructure-as-code (IaC).
Product Access Controls
ClauseOne provides robust access controls to manage user and project-level permissions, including:
- User Roles – Define what actions each user can take within the platform.
- Data Access – Govern which data connections are available and whether users can access shared or individual credentials.
- Project Access – Project owners can restrict visibility or editing rights, including access to any linked data or application logic.
SSO integrations (Google, Okta, OIDC) are supported to streamline and secure authentication.
Application Security & Development
Application Security
ClauseOne incorporates automated vulnerability scanning, including:
- Static Application Security Testing (SAST)
- Software Composition Analysis (SCA)
Code changes are peer-reviewed, automatically tested for security and stability, and deployed through secure CI/CD pipelines with branch protection in place.
System health and security metrics are continuously monitored to identify potential risks before they affect performance or data integrity.
Security Vulnerability Reporting
If you believe you've discovered a potential security issue or vulnerability in ClauseOne, we want to hear from you. Please report it directly to us at founders@clauseone.co. We take all reports seriously and investigate every submission promptly.
Contact & Further Information
To learn more about how ClauseOne secures your data or to review our detailed privacy practices, please refer to our Privacy Policy.
Security Questions or Vulnerability Reports: founders@clauseone.co