Security & Compliance

Netlify (United States). All HTTP requests are served through Netlify's global CDN. Netlify is covered by Standard Contractual Clauses for EU data transfers.

Supabase — PostgreSQL with row-level security, Supabase Auth, and private file storage buckets. All user data is stored here. Primary authentication (JWT issuance, session management, password hashing) is managed by Supabase Auth.

Supabase project region: EU (Ireland — eu-west-1). All primary user data is stored in the EU.

All connections to clearaihq.com and its API endpoints use HTTPS with TLS 1.2 or higher. HTTP Strict Transport Security (HSTS) is enabled with max-age=31536000; includeSubDomains; preload, enforcing HTTPS on all subsequent connections and preventing downgrade attacks.

Data is encrypted at rest by Supabase at the disk layer (AES-256, managed by Supabase). This covers all database records, including stored OAuth credentials.

There is no additional application-layer encryption of stored credentials beyond Supabase disk encryption. OAuth tokens are further protected by row-level security and service-role isolation (see Access Control). We do not operate a separate key management system.

Every table containing user data has RLS enabled. Authenticated users can read and modify only their own rows. Automated writers (cron functions, webhooks) run as the service role under separate credentials.

The connected_account_tokens table has RLS enabled with zero client-accessible policies — inaccessible to all client requests; accessible only via service role. No user can read another user's OAuth tokens. Legacy OAuth columns in user_profiles remain readable by the row owner only until the B4 read-cutover migration removes them — see §13 Known Gaps.

All authenticated API endpoints derive the user identity from the verified Supabase JWT via auth.getUser(). User IDs are never accepted from request bodies or query parameters. Ownership is checked before every write.

The scheduled_posts status field is governed by a SECURITY DEFINER database trigger (trg_fn_status_guard) that enforces which role may make which transition. Invalid transitions are rejected at the database layer — application code cannot bypass this.

Every state transition on scheduled_posts is written to post_audit_log by the SECURITY DEFINER trigger. The log is INSERT-only for authenticated users — no UPDATE or DELETE is permitted. This covers the post publication lifecycle. General access audit logging (who read which record, when) is not implemented.

Passwords are hashed using bcrypt via Supabase Auth. Passwords are never stored in plaintext.

Sessions are managed by Supabase Auth JWTs. Tokens are short-lived and rotated on refresh. Sessions can be invalidated server-side.

MFA is not currently available in the product UI. Supabase Auth supports MFA; wiring it into the product is on our roadmap. Target: Q4 2026

Approval-review tokens and subscriber unsubscribe tokens are stored as SHA-256 hashes. The raw token value is returned to the caller once at creation and is not stored in recoverable form. Review links use URL fragments (not query parameters) with no-referrer meta, preventing tokens from appearing in server logs of linked resources.

Incoming webhooks from Facebook, Instagram, and Threads are verified using HMAC-SHA256 (X-Hub-Signature-256) with a length-guarded crypto.timingSafeEqual comparison. Verification failures return 403 and drop the request.

Public-facing form endpoints include honeypot fields (bot filtering), server-side rate limiting (status subscriptions: 3 per hour per IP), and server-side Origin header validation on analytics ingest with per-site daily event caps.

All responses carry: X-Frame-Options: SAMEORIGIN, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, Permissions-Policy: camera=(), microphone=(), geolocation=().

OAuth flows include a state parameter. HMAC signing of the state value (CSRF protection for the OAuth callback) is on our roadmap. Target: Q3 2026

All user-generated content passed to AI models is wrapped with explicit data delimiters and a treat-as-data instruction, preventing prompt injection from user content.

Raw social media payloads (raw_payload) are never rendered in any user interface and are never passed to AI models. This column is explicitly excluded from all SELECT queries used in API responses.

AI-generated reply suggestions are written to a plain textarea. They are never auto-sent — publishing always requires explicit user action.

The ClearAI HQ website uses ClearTrack, a first-party analytics tool built into the platform. Visitor data flows directly to ClearAI HQ's Supabase database — no third-party analytics processor is involved. Nothing runs before consent is given; declining sets a permanent no-op. No IP addresses are stored. When users visit a site running ClearTrack, ClearAI HQ processes that visitor data as the site operator's processor under the DPA.

ClearAI HQ is operated from Stockholm, Sweden. We are subject to GDPR and Swedish data protection law. Our supervisory authority is the Swedish Authority for Privacy Protection (IMY).

Our GDPR Article 28 DPA is available at /dpa. It covers sub-processor authorisation, security measures, data subject rights assistance, breach notification, audit rights, and international transfer mechanisms.

Customers can exercise access, rectification, erasure, restriction, portability, and objection rights by emailing privacy@clearaihq.com. We respond within 30 days. The platform includes a per-contact GDPR export endpoint and a hard-delete endpoint for CRM data.

When a CRM contact is hard-deleted, the deletion cascades through linked visitor identities, tracking sessions, and tracking events. No orphaned analytics data is retained.

We will notify the supervisory authority within 72 hours of becoming aware of a personal data breach (GDPR Article 33). We commit to notifying affected controllers within 48 hours (DPA Article 10).

Transfers to US-based sub-processors (Anthropic, Google LLC, OpenAI LLC, ElevenLabs, Netlify, Resend, Stripe, Unsplash) are covered by Standard Contractual Clauses (SCCs) adopted under GDPR Article 46(2)(c). Supabase primary storage is in EU (Ireland — eu-west-1) — no SCC transfer required for Supabase data.

A formal DPO has not been designated. Whether one is required under GDPR Article 37 is subject to ongoing legal review. Privacy and data protection enquiries: privacy@clearaihq.com.

Every scheduled background function (17 total) writes a heartbeat record on each run. A dedicated evaluator runs every 30 minutes, derives component health from heartbeat history, and detects transitions between Operational, Degraded, and Down states.

State transitions are confirmed across two consecutive evaluation cycles before an alert fires, preventing spurious notifications from transient failures.

System status and 90-day history are public at /status. Active incidents are declared and updated publicly with a timestamped timeline. Subscribers receive email notifications when incidents are declared or resolved.

The evaluator auto-drafts an incident for administrator review when a component is confirmed down. Incidents are human-reviewed before publication. We do not auto-publish incident text without human sign-off.

Security incidents affecting personal data: controller notification within 48 hours (DPA Art. 10); supervisory authority notification within 72 hours (GDPR Art. 33). Notification is sent to the email address associated with the controller's account.

No automated backups or point-in-time recovery on the current plan (dashboard-confirmed 2026-07-28). Daily backups are planned — see RTO/RPO.

Supabase project region: EU (Ireland — eu-west-1).

Every push to main triggers a Netlify deployment. Any prior application deployment can be rolled back from the Netlify dashboard. This covers application code only — database data state at rollback time reflects whatever migrations have run. See Database backups above for data recovery.

Formal Recovery Time Objective and Recovery Point Objective targets have not been defined for v1. These depend on the Supabase plan tier. Target: Q3 2026

30 days' advance written notice required. Once per calendar year maximum (unless required by a supervisory authority). The auditor must be bound by confidentiality obligations acceptable to ClearAI HQ. All costs borne by the Controller.

As an alternative to an on-site audit, we provide written responses to reasonable security questionnaires. This is the practical route for most compliance reviews.

ClearAI HQ holds no security certifications (ISO 27001, SOC 2, or equivalent) at this time. Our infrastructure sub-processors hold their own:

Planned. No audit has been initiated. Target: 2027