Security

Who gets in

• Only the people you invite. Each person has their own access, and you choose whether they can only view or also make changes.
• Every service link has a key. Without the key, the link does not answer. Keys are kept only as a fingerprint, so not even we can read one back, and each one can be revoked on its own. See Connect your systems.

Encrypted on the way

• Every connection to the platform is encrypted: the browser, your systems calling a service, and the Claro Connector on each device all talk over HTTPS and secure WebSocket.
• A device only reaches the files of the part it is working on. It cannot read another part’s input, or another company’s.
• Download links expire. A link to download a result is signed and stops working after a few minutes.
• Functions only reach the addresses you declare. Anything else is refused.

Secrets in a vault

• The passwords and keys your services use never show up in the code. They live in a vault.
• Each secret is encrypted on its own, with AES-256-GCM and a key of its own, which in turn is protected by a master key kept outside the database.
• A secret only reaches a device when it is needed, for the part that uses it, and never shows up in the logs.

Where everything lives

Your choice. See Data sovereignty.