## How We Protect Your Data

**Infrastructure**  
Secure, scalable, AWS-based architecture.

**Access Control**  
A robust set of in-product data access and admin controls for greater visibility and control over your data.

**Data Privacy**  
Our privacy program aligns our practices with regulations such as GDPR and CCPA.

**Data Security**  
Data is encrypted, stored securely, and segregated.

**Governance, Risk, and Compliance**  
Our information security program, policies, and vendor reviews safeguard customer data.

**AI Governance**  
We employ state-of-the-art AI protections, including zero-day retention agreements and guardrails.

## Secure Infrastructure

**Network Security**  
External traffic is filtered through a Web Application Firewall with role-based security groups.

**Built on AWS**  
All infrastructure is deployed on AWS using secure configurations and VPCs.

**Data Center Redundancy**  
Data is stored in the Oregon (us-west-2) AWS region across multiple availability zones.

## Data Security

**Encryption and Protection**  
Data is encrypted in transit using TLS 1.2+ and at rest with server-side encryption in AWS S3 and DynamoDB.

**Single-Tenant Infrastructure**  
We offer robust single-tenant stacks for enterprise customers, allowing for increased data isolation.

**Logical Segregation**  
All data in our multi-tenant deployments is logically segregated, and enterprise customers can elect to add organization segregation to their single-tenant deployments.

## Access Control

**Administrator Access**  
Administrators can manage user roles, permissions, and access to projects.

**Login Security**  
We support 2FA, single sign-on (SSO), and domain-based login restrictions for enhanced security.

**Confidential Information**  
Access to customer data is restricted to authorized employees following strict confidentiality policies.

## Governance, Risk, and Compliance

**Information Security**  
We maintain a formal program to monitor and enforce security controls and compliance.

**Security Policies**  
We maintain comprehensive policies, including incident response, access control, and data retention.

**Subprocessor Management**  
Vendors are carefully reviewed and reassessed annually to ensure compliance to security and privacy standards.

## Data Privacy

**Data Deletion and DSAR**  
Customers can request data deletion or perform a data subject access request at any time.

**Data Usage**  
Customers upload specific data to Clearly AI, and that data is solely used to perform requested reviews.

## AI Governance

**AI Data Usage**  
Customer data is not used to train AI models, and guardrails are implemented to minimize hallucinations.

**Zero-Day Retention**  
We have Zero-Day Retention agreements with large language model providers, including Open AI and Anthropic.