Your logins and data stay yours
Claritty runs automations across your email, your tools, and your customers. So we built it to keep your side safe: your passwords never live inside an app, your data stays walled off, and nothing runs without your approval.
Your logins stay yours
Claritty never keeps your passwords inside an app. Your connections live in a locked vault that only the system can open, at the moment it does the work, and never in the app’s own code.
Your data stays yours
Every company’s data is walled off in its own space and encrypted. It is used to do your work, and never to train anyone’s model.
You’re always in control
Nothing important happens without your approval. Every action is recorded, so you can see exactly what ran, and undo it if you need to.
Where your logins actually live
Your app never sees your passwords. It asks a secure broker to do the work; the broker keeps your login locked away and hands back only the result.
The technical detail
The controls, encryption, compliance status and sub-processors, for reviewers and CISOs.
The controls, one by one
Credentials are encrypted and brokered server-side
Connected-integration tokens (Gmail, Slack, LinkedIn, …) are AES-256-GCM envelope-encrypted with AWS KMS, brokered through our server-side integration layer, decrypted transiently in memory only at the point of use, and never written to logs. Credentials are never persisted inside an app’s own storage.
No freeform AI codegen against your data
Apps are composed from a closed, vetted capability catalog, not improvised code with database access. Every capability an app can use went through review before it ever existed in the catalog. Submitted code is additionally run through a multi-layer security scanner before deployment.
Authenticated, fail-closed edge
Every request to a customer app passes an authentication function at the CloudFront edge that verifies identity before anything reaches the app, strips client-supplied identity headers, and stamps a verified server-issued identity. If verification cannot complete, access is denied, not allowed.
Per-app runtime isolation
Each app runs in its own isolated serverless runtime with its own database schema and connection credentials. Apps are deployed and executed independently, and each request carries a server-verified identity so an app only ever acts for the authenticated user in front of it.
Private-by-default network
Databases, caches, and file systems run in private subnets with no public IPs, reachable only from the application tier. There is no public SSH; administrative access goes through AWS Systems Manager. Traffic is TLS 1.2+ everywhere, and the API sits behind AWS WAF with platform-wide rate limiting.
Encryption at rest, everywhere it matters
The primary database (Amazon RDS) and object storage are encrypted at rest. Bring-your-own LLM keys are KMS-encrypted and used only for your workloads. Platform secrets are managed in AWS Secrets Manager and injected into services at runtime.
Identity done by professionals
Authentication is handled by Auth0, we store no passwords. API access uses RS256-signed JWTs validated against rotating public keys with strict audience and issuer checks, and account status is re-checked on every request.
Compliance status
Claritty is actively pursuing SOC 2 Type II (Security). We are not yet certified; everything on this page describes technical and operational controls already in production. We are transparent about what’s in progress: expanded audit logging and retention, centralized alerting and incident response, and automatic secret rotation.
For our current status, a detailed sub-processor list, or help with a vendor security questionnaire, email security@claritty.ai.
Sub-processors
Responsible disclosure
We welcome reports of security issues at security@claritty.ai. We’ll acknowledge your report and work with you on remediation, please give us the chance to fix before public disclosure.
Have a security questionnaire?
Send it over, we answer vendor security reviews quickly, with specifics.
Contact us