Plans from $99/month. True revenue, positions, and 27 fraud signals included.
Security, stated plainly.
Bank statements are the most sensitive financial documents your clients have. Here is where ClearStaq stores them, who handles them, how access is controlled, and where our SOC 2 work stands.
Where we stand on compliance
What is in place today, and what is still in progress.
SOC 2: in progress
ClearStaq is working towards SOC 2 Type I and Type II. No SOC 2 audit has taken place yet, and we do not hold a SOC 2 report.
Privacy requests
Where ClearStaq is the controller, we respond to access, correction and deletion requests within 45 days, consistent with CCPA and other US state privacy law deadlines.
Customer DPA
We process borrower data only on your documented instructions under our Data Processing Addendum, to perform the analysis you requested and for no other purpose.
Written policies
Our security and privacy policies are reviewed at least every 12 months and acknowledged by new personnel before they receive access to production systems.
Security training
Everyone with access completes security and privacy awareness training at onboarding, before production access, and every year after.
How your data is protected
Our applications run on Fly.io and our database and file storage on Supabase, both in the United States, with Cloudflare in front.
Encryption at Rest
Supabase encrypts the production database, file storage and daily backups at rest with AES-256. Encryption keys are managed by Supabase.
Encryption in Transit
TLS is enforced at the Cloudflare, Fly.io and Supabase edges for web, API and database traffic. Applications never open a direct Postgres connection; database access goes through supabase-js over HTTPS.
Network Security
Cloudflare sits in front of clearstaq.com, app.clearstaq.com and api.clearstaq.com, terminating TLS and providing DDoS protection. Our Fly.io apps expose only their HTTP services, and server shell access is only through Fly.io's own console.
Access Controls
Everyone has an individual account, granted on a least-privilege basis. Every member of our GitHub and Supabase organizations has MFA enabled, access is reviewed every quarter, and departing personnel lose access within 24 business hours.
Change Management
Every change to application code goes through a GitHub pull request, and the main branch is protected so it cannot be pushed to directly. Merging deploys automatically to Fly.io, and a co-founder reviews every merged pull request at our Quarterly Security Review.
Secrets & Dependencies
Production secrets are stored in Fly.io secrets and Supabase and are never committed to source control, and Dependabot monitors dependencies on all ClearStaq code repositories.
You choose how long we keep original files.
Original files (the PDFs and images you upload) are kept in ClearStaq's production Supabase project for the period your organization selects in Settings: until the account is deleted, which is the default, or for 30 days, 90 days, 6 months, 1 year, 2 years, 5 years or 7 years. When the period ends, the original file is deleted automatically, only after an email warning to your organization's owners and admins at least seven days earlier. Owners and admins can also delete a document's original file at any time. Extracted transactions and analysis results are kept until you ask us to delete them, and an owner can ask us to delete the account by emailing [email protected].
Upload
Via the app or API over HTTPS, or by email intake
Parse
Processed by our parser services on Fly.io
Deliver
Results returned to your system
Delete
Original file deleted when your retention period ends
What we store
- Original files, for the retention period your organization selects
- Extracted transactions and analysis results
- Application logs, kept for 30 days
- Database backups and Supabase logs, kept for 7 days
What we DON'T do
- ×Use your documents for anything other than the analysis you requested
- ×Email customer documents as attachments
- ×Print documents or keep paper copies
Who handles your documents.
Your documents are stored in Supabase and processed by our services on Fly.io. While a document is being parsed, a copy may be held in Upstash's managed Redis for up to one hour. When our deterministic parsers cannot read a document, it can be sent to Google's Gemini API to be parsed. Google Gemini is the only AI provider that receives documents, and it processes them for parsing only, under its data-processing agreement.
Supabase, Fly.io, Cloudflare, Postmark and Google Gemini are reviewed every year as Critical vendors, and customers are notified of sub-processor changes as their DPA requires.
Finding and fixing problems
Open findings are checked against their deadlines at our Quarterly Security Review, held by both founders every quarter.
Vulnerability SLAs
Critical findings from Dependabot are remediated within 14 days, and High findings within 30 days.
Report an Issue
Customers, vendors and security researchers can report a suspected security issue to [email protected].
Incident Response
Suspected incidents are reported internally within one hour of discovery. Affected customers are notified within 72 hours of ClearStaq confirming that an incident affected their data.
Questions about security?
Email [email protected]. It is monitored by our Security & Privacy Owner, who handles compliance questions and reports of suspected security issues.