Skip to content
Clariose

Security

Security controls, as implemented

This page describes controls that exist in the Clariose application today. We do not currently hold SOC 2 or other third-party certifications.

Encryption

  • All traffic uses TLS (HSTS enforced on the web application).
  • Uploaded documents are stored in a private Amazon S3 bucket with server-side encryption required on every upload (SSE-S3, or SSE-KMS when a KMS key is configured).
  • The managed PostgreSQL provider (Neon) encrypts data at rest.

Secure storage & uploads

  • Browsers upload directly to storage using short-lived presigned policies that pin the exact object key, content type and maximum size.
  • Documents are only viewable through signed URLs that expire within minutes.
  • Storage keys contain no names or account details.

Household isolation

  • Every request is authorized server-side against the user’s household membership and role (Owner, Member, Advisor, CPA, Attorney, Viewer). Resource IDs are never trusted on their own.
  • PostgreSQL row-level security on every household-scoped table provides a second layer: queries only see rows for the household verified for that request.

Auditability

  • Uploads, document views, deletions, reprocessing, fact corrections, finding resolutions, member invitations and removals, and exports are recorded in an audit log.
  • Audit records contain identifiers and non-sensitive metadata only — never document contents or financial values.
  • Corrections never overwrite extracted values: each change is kept as a revision with who, when and why.

AI data minimization

  • Long documents are processed section by section so only relevant pages are sent to the AI provider.
  • AI is used for reading documents and explaining results; it is never the source of truth for balances, totals, reconciliation or rules.
  • Clariose does not store Social Security Numbers, and only stores masked account numbers (last four digits).
  • AI usage is tracked per operation (provider, model, tokens, cost) without storing prompts or completions.

Application safeguards

  • Rate limiting on uploads, reprocessing, Ask Clariose, AI explanations, invitations and the advisor lead form.
  • Malware scanning of uploaded files (ClamAV) before processing, plus file-type, signature, size, corruption and password-protection checks.
  • Structured logs redact credentials, tokens, SSNs, long account numbers and document text.

User control & deletion

  • Owners and members can delete any document. Derived records, extracted text and search indexes are removed, the stored file is deleted, and reconciliation re-runs.
  • Owners can delete an entire household, which removes its stored files and data.

Deployment-level settings (bucket policies, KMS keys, database backups) are configured per environment; see the infrastructure documentation for what each deployment must enable.