Trust · Security
Verification data is some of the most sensitive data a company handles: registry records, ownership structures, identity documents, watchlist hits. Security is not a feature we added to clearbound — it is the constraint everything else was designed around.
Controls
Nothing here is an enterprise add-on. Every account gets the same encryption, isolation, and audit surface from the first sandbox call.
All traffic is TLS 1.2+ with modern ciphers; plain HTTP is rejected at the edge. Data at rest is encrypted with AES-256, with keys managed in a dedicated KMS and rotated automatically. Documents get an additional per-object envelope key.
Every query in the platform is scoped by tenant at the data layer, not in application code. Sandbox and live environments are fully separated — a verification created in one is never visible in the other, and test keys can never reach live data.
Production access requires SSO with hardware-key MFA, is granted just-in-time against a ticket, and expires automatically. No standing access to customer data exists — for engineers, support, or anyone else.
Every read and write of verification data — by your team, your API keys, or ours — lands in an append-only audit log you can query from the dashboard and export to your SIEM. Reviews and alert acknowledgements are recorded with who, what, and when.
Default retention keeps completed verifications for the regulatory minimum in your jurisdiction and original documents for 90 days. You can extend or shorten both per policy, and deletion requests purge primary stores within 24 hours and backups within 30 days.
An independent firm runs a full penetration test twice a year; findings and remediation timelines are available under NDA. Between tests we run continuous dependency scanning, static analysis on every commit, and a private bug-bounty program.
Data handling
clearbound is deliberately a system of record for decisions, not a warehouse of everything we can collect. We keep what makes a verification auditable and defensible — and nothing else.
Responsible disclosure
We take reports from outside researchers seriously and respond to every one. If you believe you have found a vulnerability in clearbound, email security@clearbound.xyz — PGP key and safe-harbor terms are included in our security.txt.
Contact: mailto:security@clearbound.xyz Encryption: https://clearbound.xyz/pgp.asc Preferred-Languages: en Policy: https://clearbound.xyz/security # Safe harbor applies to good-faith research
Start in the sandbox — same encryption, same isolation, no card required. Go live when your review is done.