ClutchedSign in

Security at Clutched

Your proposals, contracts, signatures and invoices are some of your business’s most sensitive documents. Here’s how we protect them.

Access you control

  • Each workspace's data is kept apart by row-level security in the database itself.
  • People join only by invitation from an owner or admin, or through your company's SSO when you allow it.
  • Roles for owners, admins, sales, finance and viewers. Nobody can raise their own access, and removing someone takes effect immediately.

Strong sign-in

  • Two-factor sign-in with an authenticator app, which a workspace can require for everyone.
  • SAML single sign-on with your company's identity provider, after you prove you own your domain.
  • Both rules are enforced by the database, not just the app, so they can't be bypassed.

A record of everything that matters

  • An audit log of sign-ins and every change to members, sign-in rules and integrations. Entries can't be edited, and owners can export them.
  • Every agreement records consent, each signer's details, time and IP address, and a SHA-256 fingerprint of the exact document signed.
  • Signed PDFs are locked in private storage when they're sent, so the document can't change after signing.

Encryption

  • HTTPS for every connection: the app, client links, the API and webhooks.
  • Data is encrypted at rest. Payment, accounting and CRM credentials are additionally encrypted with AES-256-GCM.
  • API keys and invitation links are stored only as hashes. Webhooks are signed so you can verify them.

Infrastructure

  • Data is stored in London, UK, with daily backups.
  • The app's servers also run in London. Your clients' payments go straight to your own payment provider account, never through ours.
  • Every change is reviewed and automatically tested before it's released.

Compliance

  • Our controls and written policies are mapped to the SOC 2 Trust Services Criteria. An independent SOC 2 audit has not been completed yet.
  • We'll share our policies on request, and give customers 30 days' notice before adding a subprocessor.

Service providers

We use a small number of carefully chosen providers for hosting, storage, email delivery and AI features, each bound by a written agreement to protect your data and use it only to provide their service. Integrations you connect yourself work with your own accounts. Our data processing agreement explains how we choose them and tell you about changes.