Trust & security
How we protect your information
We work with sensitive supplier and operational data: RFCs, tax documents, banking details. This page openly explains how we protect it, which providers we use, and the legal frameworks we operate under.
Who we are
Clauhub is the platform your business runs on, and the technical controller for data processing: hosting, database, authentication, backups and infrastructure security. As the organization that owns the record, you keep control over who accesses your information.
Four commitments by default
Encryption in transit and at rest
All traffic travels over TLS 1.2+. Data at rest is encrypted with AES-256 at the storage provider (Convex Cloud + Cloudflare R2). Sensitive secrets are additionally encrypted at the application layer with AES-256-GCM.
Least-privilege access
Roles and permissions per organization. Suppliers only see their own record. The admin team only accesses the org it belongs to.
Audit log
Every critical action (uploads, validations, status changes, token access) is recorded with a timestamp and author. Logs are retained for at least 12 months.
Incident response
If we detect unauthorized access or a breach, we contact affected organizations without undue delay and report to the competent authority within the timeframes required by law.
Authentication
Authentication is resolved on the server. Every access path is protected against brute force and credential reuse.
Passwords
Stored with strong hashing (never in plain text, never reversible). New passwords are checked against public breach databases before being accepted.
Two-factor authentication
Available for every user: TOTP (authenticator app) with backup codes. Enabling or disabling it requires the account password.
Sign-in methods
Email + password, one-time codes by email, or optional single sign-on with Google or GitHub.
Sessions and cookies
Session cookies are HttpOnly, Secure and SameSite=Lax; the token is never stored in the browser's localStorage. Resetting the password closes every active session.
Abuse limits
Per-IP rate limits on every sensitive endpoint (sign-in, one-time codes, password reset, TOTP verification). Counters live in the database, not in memory, so they survive restarts and apply consistently across instances.
No user enumeration
Recovery and code flows respond the same whether the account exists or not.
Authorization — roles and permissions
Authorization is applied on the server, on every query and mutation. It is not something the browser can bypass.
Declarative matrix
Each area of the product defines its resources (organization, users, files, reports, keys, notifications, audit log) and its discrete permissions. The matrix is checked on every endpoint before any data is returned or modified.
Predefined roles
Owner, Administrator, operational roles per area, external Consultant with expiration date, and Read-only. The organization can never be left without an Owner.
Custom roles
Enterprise plans can create tailor-made roles by combining any permissions of the matrix from the organization settings.
Account guardrails
No one can change their own role. Only an Owner can name another Owner. Sensitive credentials require their own dedicated permission, separate from configuration.
Isolation between organizations
Every request to the backend receives the organization identifier and verifies on the server that whoever is asking is an active member. Identity always comes from the session — never from data sent by the browser. Every object identifier is checked against the organization before it is used: an identifier belonging to a different organization is rejected even if it arrives in the request body.
How a file download works
Files never have a public URL. To download a document, the app requests a download link from the backend. Before issuing it, the backend validates four things:
- The user's session is valid.
- The user is an active member of the organization being used.
- Their role includes the export permission.
- The requested file actually belongs to that organization (cross-checked identifier).
Only if the four checks pass is a signed, temporary link returned by the storage service. The link is not guessable (it carries a cryptographic token) and expires shortly after being issued. It is the same model used by services like S3 presigned URLs.
HTTP security headers
Every response from the site includes:
- HSTS (Strict-Transport-Security) — HTTPS-only, enforced by the browser.
- X-Content-Type-Options: nosniff.
- Referrer-Policy: strict-origin-when-cross-origin.
- Permissions-Policy — camera, microphone and location turned off.
- X-Frame-Options: DENY + frame-ancestors 'none' — the app cannot be embedded in an iframe, which eliminates clickjacking.
AI, when you choose to use it
AI-assisted features (recommendations, OCR, document processing) run over aggregated summaries of the context — never over your raw data — and the model's response is validated before being shown. These features are optional and only run when the user explicitly triggers them.
We are formalizing the contractual agreement with the AI provider so that data sent is not used for model training.
Retention and deletion
- Deleting an organization cascades: records, files, credentials, inboxes, comments, custom fields and columns, notifications, activity and audit log.
- Deleting a user account removes their memberships, permissions, photo and preferences.
- Export: the customer can take their data out in Excel, CSV and PDF at any time.
Legal framework
We operate under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), published on March 20, 2025 — which repealed the 2010 law. The competent authority is the Secretariat of Anti-Corruption and Good Government, which replaced INAI. For customers operating in the European Union we apply GDPR on a supplementary basis; for California, CCPA/CPRA. Full details in the Privacy Policy.
Subprocessors
To deliver the service we rely on certified providers, all with contractual data-protection clauses:
Convex (US)
Database and serverless backend. SOC 2 Type II.
Cloudflare (US)
CDN, R2 storage and workers. ISO 27001 / SOC 2.
Resend (US)
Transactional email delivery. SOC 2 Type II.
Stripe (US)
Payment processing, where applicable. PCI DSS Level 1.
Anthropic / OpenRouter (US)
AI recommendations. SOC 2 Type II.
Mistral / OpenAI (EU/US)
OCR and document processing when the user requests it.
Your rights
As a personal-data subject you can exercise your ARCO rights (Access, Rectification, Cancellation, Objection) at any time. Write to the support email shown in your portal and we respond within 20 business days at most.
Questions or requests?
If you have specific concerns about how your information is handled, contact your organization's administrator through the portal. For technical platform matters, reach us via the details on the Terms page.