Security

How we store, process, and protect your data

A plain account of our security posture: where your data lives, how it is encrypted, who can reach it, and the standards we hold ourselves to.

Clarvia AS · Norway · Last updated 19 October 2026

What we store and what we don't

Clarvia checks public web pages, measures how AI assistants answer questions about your business, and writes fixes you can publish. The data we keep is what is needed to deliver that service:

• What we store: the sites and pages you add, copies of those public pages taken when we check them, the scores, findings and fixes Clarvia produces, the answers AI assistants give to the questions we track for you, brand facts you choose to give us, your account profile (email, plan, language), and usage events for billing and plan limits.
• What we do not store: we do not collect card numbers (Stripe handles payment details end-to-end). Credentials you give us so Clarvia can publish to your website are never stored in our database; they are kept in a separate key vault, described under Encryption.
• Data minimisation: copies of your pages are deleted automatically 30 days after they are taken. Scan history and the snapshots that let you undo a published change are kept for 24 months, and the AI answers recorded for your tracked questions for 12 months. Scheduled jobs delete older records every night.

Where your data lives

Your data is stored in two EU regions:

• Database and sign-in: Supabase Postgres and Supabase Auth, in the EU Central (Frankfurt, Germany) region.
• Application and files: the Clarvia app, the API and the background jobs run on Microsoft Azure Container Apps in the Sweden Central region. Page copies, report PDFs, account exports, database backups, our key vaults and our server logs are in the same Azure region.

Some AI processing happens outside the EU. Anthropic, Google (Gemini) and Perplexity are US providers, and the ChatGPT measurement runs on a Microsoft global deployment. Section 6 of the privacy policy lists each provider, what it receives and the transfer safeguard. Our databases, files and backups are not stored outside these two EU regions.

Encryption

• In transit: clarvia.io, app.clarvia.io and api.clarvia.io are served only over HTTPS. Plain HTTP requests are redirected to HTTPS, and every response sends HSTS with subdomains included. Calls from our servers to Supabase's API, Azure storage, the key vaults and the AI providers go over HTTPS.
• At rest: Supabase encrypts the database at rest (AES-256). Azure Storage encrypts page copies, PDFs, exports and backups at rest with Microsoft-managed keys.
• Credentials you give us: when you connect your website so Clarvia can publish to it, the credentials are stored as secrets in a dedicated Azure Key Vault for customer-supplied secrets. That vault is separate from the one holding our own platform secrets and has purge protection on. The credentials never enter the application database, and they are deleted from the vault when your account is erased. We have also built an extra layer for these credentials: each workspace gets its own AES-256-GCM data key, and that key is itself wrapped by a key held in Azure Key Vault. This extra layer is not yet switched on in production. Until it is, the protection is the key vault itself.

Row-level multi-tenancy

Clarvia is a multi-tenant SaaS. Every customer record (sites, pages, scans, fixes, tracked answers, billing events) belongs to a workspace. Postgres Row Level Security (RLS) is switched on for every table in our database, so a request made with a user's own sign-in token can read only what the RLS policies allow. Before the API reads or writes workspace data for someone, it checks that they are signed in and checks their role in that workspace (owner, editor or viewer). The database schema and its RLS policies are version-controlled in our repository and change only through a reviewed pull request.

The service role key, which can bypass RLS, is held in Azure Key Vault and given only to our server-side containers. It is never sent to the browser.

GDPR & data subject rights

Clarvia AS is a Norwegian data controller. We comply with the GDPR and the Norwegian Personal Data Act. Specifically:

• Right to access: request a copy of your data at post@clarvia.io. Delivery within 30 days.
• Right to erasure: the workspace owner can delete the account from the account settings, or ask us to. That starts a 30-day period in which the account can be restored. After that, a nightly job permanently deletes the sites, page copies, reports, scan history, stored website credentials and account details. Billing records are kept for the period Norwegian accounting law requires (5 years).
• Right to portability: the workspace owner can download everything we hold about the workspace as one JSON file from the account settings. Reports can be downloaded as PDF.
• Sub-processors and DPA: the full sub-processor register is section 6 of the privacy policy. Business customers can request our data processing agreement (databehandleravtale, GDPR Art. 28) from post@clarvia.io; it lists every sub-processor, retention period and security measure.
• Data processing agreements: we sign a data processing agreement with any business customer on request, for in-house teams and agencies alike.

Application security

• Authentication: Supabase Auth manages sign-in and sessions. You sign in with email and password, or with Google or Microsoft where the sign-in page offers them. Any user can add a second factor, an authenticator app or a passkey, under Settings > Security.
• Staff access: Clarvia's admin area requires a second factor (an authenticator app or a passkey). Changing a second factor needs that factor to have been confirmed within the last 10 minutes.
• Authorisation: RLS on Postgres plus role checks in the API. Every write in the admin area is recorded in an admin audit log; an automated test fails the build if an admin write route skips it.
• Secrets management: API keys and credentials are held in Azure Key Vault and reach the containers as secret references, never in source code. Every pull request is scanned for committed secrets.
• Change control: every change reaches production through a pull request. Our main branch accepts a merge only when the required automated checks pass: Python linting, strict type checks and tests; TypeScript type checks, linting and tests; end-to-end and integration tests; the secret scan; and the container image builds.
• Network surface: the application runs on managed container infrastructure with only HTTPS exposed. We run no servers of our own to log into: there is no SSH and no administrative port reachable from the internet. Operator access to the running containers goes only through Microsoft Azure's own access control.
• Backups: a scheduled job takes a full copy of the database every night at 02:00 Norwegian time and stores it in Azure Blob Storage in Sweden Central, encrypted at rest. Each backup is deleted automatically after 35 days.
• Monitoring: external uptime checks watch clarvia.io, app.clarvia.io and the API, and errors from our servers and from the browser are reported to Sentry in its EU (Germany) region.

Incident response

If we discover a security incident affecting your data, we will:

• Notify affected customers by email within 72 hours of confirming the incident.
• Provide what is known about scope, root cause, and immediate mitigations as soon as that information is reliable. We do not wait for a complete post-mortem.
• Notify the Norwegian Data Protection Authority (Datatilsynet) of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, as GDPR Article 33 requires, and notify other applicable regulators on their timelines.

To report a vulnerability or suspected incident: post@clarvia.io.

Compliance roadmap

• SSO (SAML / OIDC): on our roadmap for the Enterprise tier alongside the custom DPA and SLA. Not yet available - contact us if you need it and we'll scope timing with you.
• SOC 2 and ISO 27001: we plan to pursue SOC 2 as we grow, and ISO 27001 after it. Clarvia holds neither certification today, and no audit is scheduled yet.
• EU AI Act alignment: Clarvia's AI use sits in the limited-risk category. Transparency and human-oversight controls are already in place; we monitor the implementing acts as they are published and update the disclosure surface accordingly.

Contact

Security, privacy, vulnerability disclosures, DPAs, sub-processor lists, data-export requests: post@clarvia.io