Security Practices
Encryption
Section titled “Encryption”| Layer | Standard |
|---|---|
| Data in transit | TLS 1.2 or higher |
| Data at rest | AES-256 via cloud provider (S3, Azure, GCS) |
| PII fields in the database | Field-level encryption |
| Passwords | bcrypt with per-user salt |
Authentication
Section titled “Authentication”- Email and password login with rate limiting and brute-force protection
- Multi-factor authentication (MFA) available for all users
- Passkey / WebAuthn support planned for general availability
- Session tokens are short-lived and rotated on sensitive operations
Access control
Section titled “Access control”- All data access is scoped to the user’s organization memberships
- Claryn staff cannot access customer data without explicit authorization and audit logging
- Customer-managed storage means files are never accessible to Claryn at rest
Infrastructure
Section titled “Infrastructure”- Hosted on Cloudflare and managed cloud providers with SOC 2 Type II certifications
- No customer data stored outside Brazil and EU regions (configurable)
- Regular automated backups with point-in-time recovery
Vulnerability disclosure
Section titled “Vulnerability disclosure”Claryn follows responsible disclosure. If you discover a security vulnerability, please report it to [email protected] before public disclosure. We aim to acknowledge reports within 48 hours.
See Incident Response for the full process.