Trust & security
How we protect your information
We work with sensitive business data: RFCs, invoices, e.firma and CSD, bank statements. This page openly explains how we protect it, which providers we use, and the legal frameworks we operate under.
Service operated by Clauhub Software LLC.
On this page
Who we are
Clauhub is the platform your business runs on, and the technical controller for data processing: hosting, database, authentication, backups and infrastructure security. As the organization that owns your data, you keep control over who accesses your information.
Four commitments by default
Encryption in transit and at rest
All traffic travels over TLS 1.2+. Data at rest is encrypted by our database and storage providers (see Subprocessors). Sensitive secrets are additionally encrypted at the application layer with AES-256-GCM.
Least-privilege access
Roles and permissions per organization. Whoever comes in through a portal (a supplier or a customer) only sees what you share with them. Each team only accesses its own organization.
Audit log
Every critical action (your e.firma and CSD, issuing and emailing invoices, SAT downloads and requests) is recorded with who, what and when. Logs are retained for at least 12 months.
Incident response
If we detect unauthorized access or a breach, we contact affected organizations without undue delay and report to the competent authority within the timeframes required by law.
Authentication
Authentication is resolved on the server. Every access path is protected against brute force and credential reuse.
Passwords
Stored with strong hashing (never in plain text, never reversible). New passwords are checked against public breach databases before being accepted.
Two-factor authentication
Available for every user: TOTP (authenticator app) with backup codes. Enabling or disabling it requires the account password.
Sign-in methods
Email + password, one-time codes by email, or optional single sign-on with Google or GitHub.
Sessions and cookies
Session cookies are HttpOnly, Secure and SameSite=Lax; the token is never stored in the browser's localStorage. Resetting the password closes every active session.
Abuse limits
Per-IP rate limits on every sensitive endpoint (sign-in, one-time codes, password reset, TOTP verification). Counters live in the database, not in memory, so they survive restarts and apply consistently across instances.
No user enumeration
Recovery and code flows respond the same whether the account exists or not.
Authorization — roles and permissions
Authorization is applied on the server, on every query and mutation. It is not something the browser can bypass.
Declarative matrix
Each area of the product defines its resources (organization, users, files, reports, keys, notifications, audit log) and its discrete permissions. The matrix is checked on every endpoint before any data is returned or modified.
Predefined roles
Owner, Administrator, operational roles per area, external Consultant with expiration date, and Read-only. The organization can never be left without an Owner.
Custom roles
Enterprise plans can create tailor-made roles by combining any permissions of the matrix from the organization settings.
Account guardrails
No one can change their own role. Only an Owner can name another Owner. Sensitive credentials require their own dedicated permission, separate from configuration.
Isolation between organizations
Every request to the backend receives the organization identifier and verifies on the server that whoever is asking is an active member. Identity always comes from the session — never from data sent by the browser. Every object identifier is checked against the organization before it is used: an identifier belonging to a different organization is rejected even if it arrives in the request body.
How a file download works
Files never have a public URL. To download a document, the app requests a download link from the backend. Before issuing it, the backend validates four things:
- The user's session is valid.
- The user is an active member of the organization being used.
- Their role includes the export permission.
- The requested file actually belongs to that organization (cross-checked identifier).
Only if the four checks pass is a signed, temporary link returned by the storage service. The link is not guessable (it carries a cryptographic token) and expires shortly after being issued. It is the same model used by services like S3 presigned URLs.
HTTP security headers
Every response from the site includes:
- HSTS (Strict-Transport-Security) — HTTPS-only, enforced by the browser.
- X-Content-Type-Options: nosniff.
- Referrer-Policy: strict-origin-when-cross-origin.
- Permissions-Policy — camera, microphone and location turned off.
- X-Frame-Options: DENY + frame-ancestors 'none' — the app cannot be embedded in an iframe, which eliminates clickjacking.
AI, when you choose to use it
AI features (assistant, dashboard notes, bank statement reading, search) send the model what each task needs, and its response is validated before being shown. Requests go only to zero-data-retention providers.
No provider trains on your data: OpenRouter only routes to zero-retention providers, and Mistral is contractually barred from training on what it receives.
Retention and deletion
- Deleting an organization cascades: records, files, credentials, inboxes, comments, custom fields and columns, notifications, activity and audit log.
- Deleting a user account removes their memberships, permissions, photo and preferences.
- Export: the customer can take their data out in Excel, CSV and PDF at any time.
Legal framework
We operate under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), published on March 20, 2025 — which repealed the 2010 law. The competent authority is the Secretariat of Anti-Corruption and Good Government, which replaced INAI. For customers operating in the European Union we apply GDPR on a supplementary basis; for California, CCPA/CPRA. Full details in the Privacy policy.
Subprocessors
To deliver the service we rely on these providers. Customers under contract get at least 30 days' notice before we add one.
Last updated: October 25, 2026.
See the full list of subprocessors →Your rights
As a personal-data subject you can exercise your ARCO rights (Access, Rectification, Cancellation, Objection) at any time. Write to soporte@clauhub.com and we respond within 20 business days at most.
Questions or requests?
If you have concerns about how your information is handled, write to soporte@clauhub.com; to report a security issue, to ops@clauhub.com. If your data is kept by an organization that uses Clauhub, you can also contact it. The service's conditions are in the Terms.
Frequently asked questions
Where does my data live?
In a PostgreSQL database and in Cloudflare's storage; the list of providers, with what each one does, is at Subprocessors. On top of their encryption, we encrypt the most sensitive secrets at the application layer with AES-256-GCM.
Are you certified?
We rely on infrastructure providers with their own compliance programs; card payments are processed by Stripe, not us. The full list is at Subprocessors.
Do you store card data?
No. Payments are processed by Stripe; we only store a customer identifier and a description ("Visa ending in 4242").
Do you offer two-factor authentication?
Yes. TOTP (authenticator app) with backup codes, enabled per user from the profile. Enabling or disabling it always requires the account password.
Can I export my data if I cancel?
Yes. You can export everything (Excel, CSV, PDF and original files) at any time. Deleting an organization cascades: records, files, credentials, inboxes, comments, notifications, activity and audit log.
How do I report a security issue?
Write to ops@clauhub.com describing the problem, how to reproduce it and its impact. We respond within 72 business hours and follow up until closure.