Delivering world-class security and privacy standards
At Clive, data protection is a top priority — and has been from the very beginning. We protect your data with trusted infrastructure, rigorous auditing, and continuous compliance monitoring.
Clive runs on fault-tolerant AWS infrastructure engineered for availability, even during peak demand.
All customer data is encrypted at rest and in transit. HTTP is redirected to HTTPS, and secrets are protected with AWS KMS.
All data is secured in Amazon Web Services (AWS) facilities in the USA, with enterprise-grade physical and network security.
Clive holds a SOC 2 Type II attestation from an independent auditor and continuously monitors 140+ controls with Drata.
Servers run in Clive's own VPC behind restricted security groups, with least-privilege access and separate development, testing, and production environments.
Third-party application penetration tests and network vulnerability scans at least annually, alongside Clive's internal testing program.
Audited against the AICPA Trust Services Criteria.
Each year, Clive obtains a SOC 2 Type II attestation report by an independent auditor, objectively certifying the controls that keep customer data secure. Security policies are maintained, communicated, and approved by management — and audited annually as part of the certification. A third party security firm does a comprehensive penetration test, and both findings and remediations are audited as part of the SOC 2 process.
Security is built into how we ship.
Code development follows a documented Secure Development Life Cycle, and development and testing environments are fully separate from production.
- The security team reviews the design of all new product functionality before it ships.
- Mandatory code reviews for every code change.
- Periodic in-depth security reviews of architecture and sensitive code.
- At least annually, engineers train on the OWASP Top 10, common attack vectors, and Clive's security controls.
- Development and testing environments are separate from production.
Enterprise-grade controls, in the product.
Web application architecture and implementation follow OWASP guidelines.
Authenticate users without requiring them to enter separate login credentials for your Clive instance.
Administrators can see when users last logged in and what features they used. Logs are kept for at least one year.
All access to Clive applications is logged and audited, and a formal incident response plan covers major events.
You stay in control of your data.
Data access and authorizations are granted on a need-to-know basis, and access to production systems is restricted to authorized personnel.
Customers may configure a data retention duration for their Clive instance, with data held in industry-standard storage systems at AWS.
Customer data is purged from Clive systems subsequent to contract termination.
Found a security issue?
If you have discovered a security issue that you believe we should know about, please reach out to us at security@cliveapp.ai.
Start free
One week on us, no card required.