Managed, audited data layer
Managed PostgreSQL on a platform holding SOC 2 Type II and ISO 27001 certifications, with row-level security enforcing tenant isolation at the database itself.
Trust & security
Security at ClearStax.
ClearStax is where MSPs keep their clients' operational record. We hold the platform to the same evidence-led standard the platform produces.
Platform foundations
Security built into the substrate, layer by layer.
ClearStax runs on certified, audited infrastructure with security designed into every layer — from the edge your traffic enters through to the tenant-isolated store your record lives in.
Hardened edge
A global edge network with always-on DDoS protection and TLS termination. All traffic is proxied through Cloudflare before it reaches the platform — origin infrastructure is never exposed directly.
Dedicated US compute
Application compute runs on dedicated, hardened infrastructure in the United States (Oregon), with isolated capacity for background jobs and the agent workforce.
The operating substrate · illustrative
Surface operator dashboard · client portal · reports
Control governed agents · reviewers · gated actions
State pipeline · tickets · evidence · reports
Data tenant-isolated system-of-record store
Every layer above the store inherits the same tenant boundary — the isolation enforced at the data layer holds for dashboards, agents, and reports alike.
Data protection
Encrypted, isolated, and backed up — always.
Your clients' data is protected in every state it exists in: at rest, in transit, across tenant boundaries, and in backup.
- REST
Encryption at rest
Database volumes and backups are encrypted at rest with AES-256. The most sensitive fields carry an additional layer of application-level AES-256-GCM encryption with per-tenant keys — protected even inside the database.
- TLS
Encryption in transit
TLS 1.2+ enforced on every external connection — all API traffic and webhooks. Internal service traffic stays on a private host network, isolated from the public internet.
- RLS
Tenant isolation
Row Level Security (RLS) enforces tenant boundaries at the database layer, backed by defense-in-depth tenant scoping in every application query — so one tenant cannot read another's records.
- BAK
Daily backups
Automated, encrypted daily backups on the SOC 2 Type II managed data platform.
Agent workforce
Securing the agent workforce.
ClearStax doesn't just show you data — agents observe and propose work on your behalf, and earn the right to act as you raise their trust phase. Every agent runs inside a governance layer you control, so autonomy is earned, bounded, and accountable.
Trust ladder
Every agent begins in an observe-only Shadow phase and is promoted through Supervised, Audited, and Bounded phases — per tenant, under your control. An agent never acts beyond the autonomy you've granted it.
Instant kill-switch
AI execution can be halted platform-wide in an instant. Every dispatch checks the kill-switch before it runs, so there's always a hard stop.
Input & output guardrails
Untrusted content is wrapped and isolated before it reaches a model, and every completion is screened by an output guardrail before it's used. Authorization is never inferred from model output.
Token & cost budgets
Per-tenant and per-agent token and cost budgets cap spend and contain runaway usage. An agent that exceeds its budget is blocked before the next call — it can't quietly burn resources.
Every call on the record
Each model call is recorded — provider, model, prompt and output fingerprints, token count, and cost — scoped to your tenant. The agent workforce produces the same evidence trail as everything else in ClearStax.
Access control
Authentication & access control.
Defense in depth for every user and every session.
- MFA
Multi-factor authentication
MFA support via TOTP authenticator apps, included for every account — no add-on required to secure access.
- RBAC
Role-based access control
Granular RBAC with predefined roles (Admin, Manager, Analyst, Read-only). Assign permissions per user, per tenant.
- SESSION
Session management
Secure, short-lived JWT tokens with automatic refresh. Sessions expire after inactivity, users can revoke their own active sessions, and admins set tenant-wide session policy.
- AUDIT
Audit trail
Every login, data access, and configuration change is logged with timestamp, user ID, and IP address.
Our posture
Our own security posture.
We hold the platform to the same evidence-led standard we build into the product.
Least-privilege access & audit logging
Production access is least-privilege and reviewed, and every privileged action is logged. Tenant data is isolated at the database with row-level security, so one tenant can never read another's records.
Provenance by design
Encryption, access control, audit logging, and tenant isolation are foundations — but the differentiator is provenance. Every record carries a source, an owner, and a timestamp, linked back to the work that produced it, so a control claim can always be traced to its origin.
Penetration testing
We plan independent third-party penetration testing as we grow; results and remediation details will be shared with enterprise customers on request.
Data processing locations
Your primary operating record — database and self-hosted analytics — is stored in the United States (Oregon). Specific functions rely on vetted sub-processors (for example payments, email, SSO, and AI) under data-processing agreements; we share the current sub-processor list on request.
Responsible disclosure
Found a security vulnerability?
We take every report seriously. Please disclose responsibly by emailing us directly — do not open a public issue.
We aim to acknowledge reports within 48 hours and resolve confirmed vulnerabilities promptly.
Questions about our security practices?
We're happy to walk through our security architecture during your demo.