PricingSecurityDocsSign in
Security & Trust

Security is our product

We're a security company. Our customers trust us with their most sensitive telemetry. Here's exactly how we protect it.

Encrypted at rest & in transitOWASP headers on all responseshttpOnly cookie auth — no localStorage tokens

Authentication & access control

JWT + httpOnly cookies
Access tokens live in httpOnly, Secure, SameSite=Strict cookies — never in localStorage or sessionStorage. A separate refresh token rotates every 7 days. Token reuse triggers automatic revocation of all sessions for the affected user.
Role-based access
7 roles: PlatformOwner, Admin, Analyst, Viewer, Auditor, Helpdesk and ReadOnly. Executing a response action needs the Admin or Analyst role. Blocking an IP and isolating a device always go to approval, whatever the tenant's autonomy settings, and ARGUS never acts on its own on a Critical incident.
Short-lived sessions
An access token lives for your tenant's session timeout, capped at 2 hours — so 2 hours on the default 8-hour timeout, and less if you shorten it (down to 5 minutes). The client refreshes silently using the refresh token cookie scoped to /api/auth. If the refresh token is expired or revoked, the user is signed out immediately.

Data isolation & encryption

Every database row carries a TenantId column. All EF Core queries are scoped to the authenticated tenant at the ORM level — a query cannot return another tenant's data without bypassing the typed DbContext. The event store, the cache and the job queue are shared infrastructure, not one instance each: isolation there comes from every read carrying a mandatory tenant filter, which is the part covered by regression tests. We would rather tell you where the boundary actually is than claim a separation we do not run.

LayerHow we protect it
DatabasePostgreSQL with TenantId row-level scoping enforced at ORM level on every table
Event storeOne PostgreSQL table shared by every tenant; every read carries a mandatory tenant filter, enforced by test
TransportTLS 1.2 or 1.3 from your browser to Railway's edge, which terminates it before requests reach the app. TLS 1.0 and 1.1 are refused
SecretsEnvironment variables injected at deploy time, never committed to source code
BackupsHourly PostgreSQL backups and a daily archive of the security-event store, both to Amazon S3 with server-side encryption. Railway also takes recurring volume backups

Network & API security

OWASP security headers
X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy, HSTS (max-age 2yr + preload), Content-Security-Policy, and Permissions-Policy on every response.
Rate limiting
Per client IP: sign-in and password reset 10/min, public forms 30/min, endpoints that queue real work 20/min, and a 1000/min backstop on everything else. The public API is limited to 100/min per API key. Exceeding a limit returns 429 with a Retry-After header.
CORS
Strict origin allowlist. Credentials are never sent cross-origin. Allowlist is an explicit env-var-driven whitelist — never a wildcard.
Input validation
All request bodies are validated against strongly-typed C# records before reaching any handler. Malformed payloads return 400 before any DB interaction.
Audit logging
Every auth event, permission change, and response action is written to an audit log with actor ID, tenant ID, IP, and timestamp. Autonomous-action records are append-only, enforced by database triggers that block updates and deletes. The general audit log rejects any rewrite too, and is kept for its retention window.
Error monitoring
Sentry captures all unhandled exceptions in production with full stack traces. PII is scrubbed from payloads before transmission.

Data handling

Retention
Security events are kept for 365 days by default, tenant-configurable from 30 days to seven years. Incidents follow their own window — 365 days by default, and only once they are resolved or marked a false positive; an open incident is never deleted by age. The audit trail has a hard floor of 365 days that a tenant can lengthen but not shorten, including the record of them trying. A legal hold suspends all of it.
Deletion
Closing an account soft-deletes it immediately — access is blocked the same minute — and a background purge hard-deletes every tenant-scoped row after a 30-day grace window, so an accidental closure is recoverable. Two things deliberately survive it: the immutable ARGUS forensic log, which database triggers physically prevent deleting, and a “removed” tenant stub that keeps the remaining audit trail valid. If your policy requires those gone too, say so before you sign — it is a conversation, not a checkbox.
Subprocessors
The full list, our data-processing terms and the DPA live in the privacy policy, which names Anthropic as the LLM provider and states plainly that your data is not used to train third-party models. Kept in one place on purpose, so the two pages cannot drift apart.

Vulnerability management

We run a live penetration test against ClearSOC — actively attempting cross-tenant data access, authentication bypass, and privilege escalation — alongside OWASP ZAP baseline scans on every major release. A passing harness tells you what the harness covered, not what the product withstands; see the correction below. Our CI pipeline runs static analysis (Roslyn analyzers) and secret scanning on every pull request, and dependencies are monitored for CVEs via GitHub Dependabot and patched within 7 days of disclosure.

Correction — August 2026. This page previously reported our July penetration test as 49 active-exploitation checks with 0 failures, and stated that cross-tenant data access had been attempted and failed. An August validation program found that result was a statement about our harness, not our product: it had never exercised the Jira OAuth callback, which accepted an unsigned state parameter and allowed an unauthenticated cross-tenant compromise. That finding and two further launch blockers are closed, each covered by a regression test that fails against the pre-fix code. Our current security report opens with a table of the July claims that were not true when we made them.
Our last ZAP scan returned 0 FAIL findings. All warnings were informational — SRI attributes on Vite content-hashed assets, which is intentional and equivalent in security posture.
On our roadmap
Not scheduledSOC 2 Type II — no auditor engaged yet
Not scheduledIndependent third-party penetration test + published report
Q4 2026Public bug bounty program

Responsible disclosure

We take vulnerability reports seriously. There is no staffed rotation behind the address yet, so response is best-effort while we are pre-launch — the same thing the trust center says, because a promise that differs between two pages is not a promise. Please don't publicly disclose until we've had a chance to fix and ship.

Security reports
security@clearsocapp.com
PGP key available on request.

Have a security question?

Talk to our team before you sign. We're happy to answer anything.

Contact security team