24-hour scan access
Session access expires after 24 hours. Scheduled cleanup automatically purges raw files and row-level snapshots; instant Delete Now is available throughout the scan.
Institutional Trust & Security Dossier
Your data, verified.
Deterministic calculations, cryptographic session boundaries, automated 24-hour deletion, and subprocessor infrastructure controls for Clarivect.
Private session access
Anonymous scans use CSPRNG tokens held in HttpOnly SameSite cookies. Server validates SHA-256 token hashes with zero plaintext persistence.
No model training
Uploaded financial data and customer payloads are never used for model training. Inference operates exclusively under signed enterprise Zero Data Retention (ZDR) agreements.
Explainable results
Financial calculations evaluate through versioned algebraic invariants. Missing information limits conclusions explicitly rather than hallucinating facts.
Scan access and deletion
Session access expires strictly after 24 hours. Automated background cleanup permanently removes expired source files, customer snapshots, row repairs, findings, and temporary reports. Delete Now provides immediate client-initiated purging at any point during active analysis.
swipe table horizontally →
| Data Category | Retention Bound | Storage Medium | Deletion Method | Verification |
|---|---|---|---|---|
| Source Receivables CSV | Strict 24 Hours | Private Storage Bucket | Cron + Instant "Delete Now" | Permanent bucket purge |
| Parsed Invoice Records | Strict 24 Hours | Isolated Database Partition | Cascade Foreign-Key Deletion | Row purge on session delete |
| Assurance Brief (PDF) | Strict 24 Hours | Deterministic Stream / Temp | Scrubbed on session expiry | User local file copy only |
| Account Lineage Record | Account Lifespan | Encrypted User Schema | Self-Serve Account Deletion | No invoice line details retained |
Downloaded reports remain stored exclusively on your device; server-side deletion permanently destroys all operational records from active infrastructure.
Private session access
Anonymous scans use an ephemeral session token generated via cryptographically secure pseudo-random number generators (CSPRNG). The token is held in an HttpOnly, SameSite, Secure cookie, preventing client-side JavaScript execution contexts from reading session credentials.
swipe table horizontally →
| Security Parameter | Standard | Technical Invariant |
|---|---|---|
| Token Generation Entropy | 256-bit CSPRNG | Native crypto.randomUUID() random distribution |
| Token Persistence | SHA-256 Hash | Raw session token never written to database tables |
| Cookie Attributes | HttpOnly; SameSite=Lax; Secure | Protected against XSS exfiltration and CSRF vectors |
| Cross-Session Isolation | Session Hash Filtering | Zero cross-session data leakage; non-matching queries return HTTP 404 |
How findings are produced
Parsing, date evaluation, outstanding balance verification, ageing buckets, duplicate identification, and attention priorities are executed exclusively through versioned, deterministic algebraic rules. Multi-currency exposure amounts remain isolated by ISO currency code and are never summed across currencies without explicit FX execution context.
The Receivables Action Plan and Assurance Brief rigorously distinguish supplied raw facts, deterministic calculations, missing context, and suggested operational next steps. The scanner does not predict future customer behavior, synthesize unstated agreements, or dispatch communications without verified human authority.
Linking a scan to an account
Creating an account or signing in does not automatically archive your uploaded invoices or report. With your explicit opt-in, Clarivect records a lightweight linkage record connecting the scan reference, workspace identifier, ruleset version, financial direction, and conversion timestamp.
This account record does not retain raw invoice lines, debtor names, individual balances, or customer identifiers. Read the account lineage specification in the privacy policy.
AI workflow engineering governance
For custom AI workflow engineering engagements, automation pipelines execute within your dedicated virtual private cloud (VPC), client-isolated private tenant, or on-premises environment. Foundation model inference operates exclusively over enterprise API agreements with strict Zero Data Retention (ZDR).
ZERO DATA RETENTION & CODE OWNERSHIP INVARIANTS
- Zero Model Training: Client operational data, invoice attachments, and contract terms are never retained for model fine-tuning.
- 100% Client Code Ownership: Extraction schemas, deterministic invariant validators, and policy circuit breakers remain client-owned.
- Human Authorization Circuit Breakers: Autonomous AI reasoning stops at policy boundaries; high-consequence mutations require explicit human approval.
Consequential mutations to production ERP or CRM ledgers are guarded by least-privilege API scoping and immutable audit logs. Explore AI workflow engineering capabilities.
Hosting and verification
The core scanner architecture utilizes isolated, serverless execution environments with encrypted data transmission and storage. Below is the active directory of verified subprocessors and encryption standards.
swipe table horizontally →
| Subprocessor | Service Function | Data Center Region | In Transit | At Rest |
|---|---|---|---|---|
| Supabase (PostgreSQL) | Ephemeral Session & Storage | ap-south-1 (Central) | TLS 1.3 | AES-256 |
| Dedicated Node.js Runtime | Deterministic Analysis Engine | Client VPC / Isolated Server | TLS 1.3 / HSTS | Ephemeral (No disk cache) |
| Resend | Transactional Brief Delivery | US-East / EU | TLS 1.3 | Zero Operational Retention |
| Stripe | Billing & Subscription Gateway | Global / PCI-DSS Level 1 | TLS 1.3 | Tokenized Vault |
Repository test suites continuously verify calculation fixtures, session token hashing, workspace authorization boundaries, and automated deletion routines. Formal external SOC-2 Type II audit readiness is maintained under continuous evidence collection.
Operator, Vulnerability Disclosure & Contact
Clarivect is operated by Sailesh Krishnan. For security advisories, vulnerability disclosures, privacy rights inquiries, or immediate deletion requests, contact the operator directly:
Vulnerability Disclosure Safe Harbor
We welcome vulnerability reports from independent security researchers. We commit to a maximum 24-hour initial acknowledgement SLA for verified security findings. We provide full legal safe harbor for research conducted in good faith without data exfiltration or service disruption.
Security discovery protocol conforms to RFC 9116: /.well-known/security.txt.