Security
Trust for AI investment decisions
Clerko evaluates enterprise AI investments. Use this page for a buyer-ready overview—then request a DPA or security review when you need contractual detail.
Security at a glance
- Tenant isolation
- Org-scoped queries + PostgreSQL RLS
- Encryption in transit
- TLS for production HTTPS origins
- Sessions
- Opaque hashed tokens · HttpOnly · SameSite
- Backups
- Documented backup/restore runbook + rehearsal script
- Data retention
- Controlled by your workspace data and legal settings
- SSO
- Enterprise plan feature (live IdP when contracted)
- Finance integrity
- Deterministic Go engine authors ROI metrics
- Security / DPA contact
- legal@clerko.com
Organization-scoped isolation
Workspace data is scoped to your organization. Application queries and PostgreSQL row-level security enforce tenant boundaries so one customer cannot read another’s initiatives.
Session and request security
Sessions use opaque hashed tokens with HttpOnly, SameSite cookies. State-changing requests are origin-checked. Rate limits fail closed when the limiter is unavailable.
Hosting and operational posture
Production configuration refuses insecure defaults. Security headers (frame deny, referrer policy, permissions policy, HSTS when cookies are Secure) ship with the API. Backup and restore procedures are documented for operators.
Deterministic finance engine
ROI, payback, and related financial metrics are calculated in Clerko’s Go engine. Language models may propose and explain—they do not author the numbers that appear in your investment brief.
Explainability by design
Facts, assumptions, evidence quality, and recommendation rationale remain visible. Leaders can see why a figure exists before they fund an initiative.
Agent boundaries
The advisor agent does not receive direct database access, arbitrary network tools, or tenant-crossing capabilities. Authorization and calculations stay in the application layer.
What we do not claim
We do not display SOC 2, ISO 27001, or similar certification badges unless they have been independently attained and validated. Engineering posture is not compliance theater.