01Data protection
- In transit. TLS 1.2 minimum, with TLS 1.3 negotiated by all modern browsers. HSTS enabled with a 2-year max-age and preload.
- At rest. AES-256 on the database and file storage, managed by Supabase. Card numbers never touch our systems. Stripe holds them.
- Database isolation. Every row is tagged with a tenant_id. Postgres row-level security enforces it; the app can't accidentally read across tenants because the database refuses.
- Backups. Daily encrypted database backups, managed by Supabase.
02Access control
- Customer side. Role-based access (admin, owner, manager, office, employee) plus per-tech permissions for sensitive views like job costing. Optional SSO is on the Business plan roadmap (Google Workspace + Microsoft Entra).
- Claver staff. Production access is limited to the people who run Claver. No shared accounts.
03Application security
- Every change runs the automated test suite, and the production bundle is scanned for leaked secrets.
- Responsible disclosure policy with safe harbor for researchers, see "Responsible disclosure" below.
- Content Security Policy on every page, limiting which outside scripts can run.
04Hosting and network
- Web hosting: Vercel (edge) for the marketing site and app shell. Origin servers in the U.S.
- Database + storage: Supabase (US-East-1).
- DNS: Cloudflare. Vercel provides edge caching and DDoS mitigation.
- Rate limiting on sign-in and sign-up, handled by Supabase Auth.
05Payment security
All card capture happens in a Stripe-hosted iframe. We never see, log, or store card numbers. Claver inherits Stripe's PCI DSS Level 1 attestation by virtue of using their elements; we file SAQ A as the merchant of record for our own subscription billing.
06Incidents
If we discover a personal-data breach, we'll notify affected customer admins within 72 hours via the email on the account, and post a notice on this site. Notice will include what happened, what data was affected, what we're doing about it, and what you should do. We don't make excuses or blame Cloudflare.
We track every incident with a written post-mortem (timeline, root cause, what changed). Customers can request the post-mortem under NDA.
07Business continuity
- RPO (recovery point objective): 24 hours. Realistic recovery during a regional outage: under 4 hours from the latest backup.
- RTO (recovery time objective): 4 hours.
- If the company itself fails, you can export everything as CSV any time.
08Audits and certifications
- PCI DSS. SAQ A filed annually for subscription billing.
- HIPAA, not in scope. Claver is not a HIPAA business associate; don't store PHI here.
- SOC 2 and ISO 27001, not certified.
09Responsible disclosure
Found a vulnerability? Don't tweet it. Email [email protected] with PoC. We acknowledge within 24 hours and respond within 5 business days.
Safe harbor: good-faith research that complies with this policy is authorized. We won't pursue legal action against researchers who follow it. Out-of-scope: physical attacks on staff, social engineering of customers, DoS, automated scans that overwhelm services.
Rewards: we may reward valid, previously unreported findings at our discretion, based on severity.
10Contact
Security: [email protected] · security.txt
Abuse / TCPA / spam / Legal: [email protected]