Trust

Customer data is encrypted in transit and at rest. Each customer is provisioned a dedicated environment with isolated data — there is no shared multi-tenant database between customer organisations. Access to production systems is role-based and limited to staff who need it, with audit logging.

Strong authentication is enforced for staff access to production systems. Customer admin / manager / salesperson roles inside the product enforce least-privilege access for end users. Administrative actions are logged.

Customer environments are backed up automatically on a regular schedule. We monitor uptime continuously and design for high availability across the components we operate. Where third-party services we depend on experience an outage, we work to mitigate impact and notify affected customers.

We process customer business data solely to operate the service. We do not sell customer data. Sub-processors are bound by contractual data-protection terms. See our Privacy Information for the full picture.

Operations are governed by Canadian privacy law (PIPEDA). For customers and end-users in the EU and UK we recognise GDPR-style rights and provide mechanisms to exercise them — see Your Privacy Choices. We do not currently claim third-party certifications on this page; please contact us if you need additional assurances for procurement.

If a security incident occurs, our process is to contain, investigate, communicate with affected customers without undue delay, and remediate. We may notify regulators where required by law.

Security researchers — please see our Responsible Disclosure page for how to report a vulnerability. We treat reports confidentially and work in good faith with the reporter.

Security or trust questions: hello@clavix360.app — Ottawa, Canada.