🔒 Security & Trust

Your contracts deserve
proper protection.

We process commercially sensitive documents. This page tells you exactly how we handle your data — where it's stored, who sees it, when it's deleted, and what we never do with it.

🇩🇪

EU Infrastructure

All data processed on Hetzner servers in Germany. Never leaves EU jurisdiction.

🛡️

GDPR Compliant

Full compliance with UK GDPR and EU GDPR. DPA available on request.

🗑️

Auto-Deleted

Contract text is automatically deleted after 90 days. No permanent storage.

🚫

Never Used for Training

Your contracts are never used to train AI models. Ever. Under any circumstances.

Infrastructure

Server location	Hetzner data centre, Germany (EU)
Data jurisdiction	European Union at all times
Transfer outside EU	✗ Never
AI provider	Anthropic Claude API (contract text sent for analysis, not retained by Anthropic for training per their commercial API terms)
PDF generation	Gotenberg — self-hosted on same EU server
Email delivery	Brevo — EU-based provider, GDPR compliant
Payments	Stripe — PCI DSS Level 1 certified. We never see or store card details.

Data Handling

Contract text storage	Stored encrypted for up to 90 days to deliver your report, then automatically deleted
Report data	Risk metadata (score, category counts) may be retained in anonymised form for product improvement
Lead data	Email, name, company retained for account management and (with consent) marketing. Deletable on request.
AI training	✗ Your contracts are never used to train any AI model
Third-party sharing	✗ We never sell or share your contract data
Contract access	Only you can access your report. No Clavico staff read your contracts.

Technical Security

All traffic served over HTTPS/TLS — unencrypted access blocked
API endpoints protected by HMAC token authentication
CORS locked to getclavico.com — no cross-origin access
Credit endpoint rate-limited to prevent abuse
Race conditions on credit deduction and promo redemption fixed at database level
Database credentials stored in environment variables, not in code
Port 8082 (API) locked to localhost — not directly accessible from the internet
Git history audited — no credentials or secrets in version history

Compliance

Clavico is built to meet the requirements of UK GDPR (as retained by the UK Data Protection Act 2018) and EU GDPR (Regulation (EU) 2016/679). Our legal basis for processing contract data is contractual necessity — you submit a contract to receive the service you've purchased.

We do not use legitimate interests as a catch-all basis. Marketing communications are only sent with explicit consent, and you can unsubscribe at any time.

Data Processing Agreement (DPA)

If your organisation requires a signed Data Processing Agreement before approving Clavico for contract review — for example, as part of an ISO 27001 or SOC 2 vendor assessment process — please contact us and we'll provide one within 2 business days.

Request a DPA → [email protected]

What Clavico Does Not Do

✗ Store your contract text permanently
✗ Use your contracts to train AI models
✗ Share your data with third parties for commercial purposes
✗ Transfer data outside the EU
✗ Allow Clavico staff to read your contracts
✗ Store payment card details (Stripe handles all card data)

Questions about security or data handling?

Email: [email protected]

For DPA requests, subject access requests, or data deletion requests — we respond within 2 business days.

Clavico provides commercial contract intelligence only. It does not constitute legal advice. Last updated: October 2026.

Your contracts deserveproper protection.