Security

Paying for a subscription

Card payment is not available yet. Subscriptions are paid by bank transfer in euro, and the transfer details are shown on the payment step of checkout. A virtual POS application with an acquiring bank is in progress; the two card-specific measures below take effect on the day it is granted, and are stated here in advance so that what will change is on the record rather than announced afterwards.

• The connection is encrypted in transit, as set out under Encryption in transit below.
• Your workspace is isolated from every other customer’s, enforced by the database itself and not only by the application — see Workspace isolation below.
• WHEN CARD PAYMENT IS ENABLED: card details will be entered on the acquiring bank’s own hosted payment page, and will not be sent to, processed by, or stored on Clavix 360° servers.
• WHEN CARD PAYMENT IS ENABLED: every card transaction will be verified with 3D Secure by the bank that issued the card.

A refund of a card payment is returned to the same card the payment was made with. The Refund and Cancellation Policy sets out how to ask for one, and what governs how long it takes.

Where your data is held

Your data is held in the European Union and is processed only to run the service for you. The categories of third party we use to deliver it, and the region of each, are set out on the Sub-processor List, which is published because data-protection law requires that disclosure. This page describes how the platform behaves; it does not name the components it is built from.

Encryption in transit

Everything between you and the platform is encrypted in transit. Only current versions of TLS are accepted and older ones are refused. Strict Transport Security is sent on every response, so a browser that has visited once will not be downgraded to an unencrypted connection afterwards. Certificates are renewed automatically, and an expired certificate is therefore not a failure mode we rely on anyone to notice. Backups are encrypted before they are written — see Backups below.

Workspace isolation

Each customer’s data is held in its own isolated workspace. The separation is enforced by the database itself rather than by application code, on every table and for every query: a request issued in one workspace cannot return another workspace’s rows even if the application asks it to. That is deliberate — an isolation rule that lives only in application code is one forgotten condition away from failing, and the database is the layer no query can go around.

Access control

Access within a workspace is role-based. Each role carries an explicit capability set, and a role that does not hold a capability cannot perform the action, whether it is requested through the interface or directly against the API. Two-factor authentication is available on any account, and an administrator can require it for everyone in the workspace.

Your data stays yours

You can export your own data from inside the platform at any time, without asking us and without waiting for us. We would rather you never feel locked in: a customer who can leave is a customer who stays because the product is worth paying for.

Backups

The database is backed up every night on an automated schedule, and each backup is encrypted before it is written. Every nightly backup is also copied to separate off-site storage, and the copy is confirmed present before the job reports success: a failed off-site copy ends the job with an error rather than passing quietly. Older backups are pruned automatically, in both places, so that retention is a schedule rather than a habit. Restoring from a backup is a documented procedure with a written runbook and a script that performs it.

What we do not claim

We hold no ISO 27001 certification, no SOC 2 report, and we have not commissioned an external penetration test. We would rather tell you that than imply otherwise. If your procurement process requires any of these, write to us and we will tell you honestly where we are.

Reporting a vulnerability

If you believe you have found a security issue, write to info@clavix360.app. Please give us a reasonable period to respond before disclosing it publicly.