Encryption & secrets
Every sensitive value you give Clarify — a payment key, an access token, a webhook secret, your own bot token, a connector's credentials — is encrypted before it is stored. It is never written to our database in plain text, and once saved it is never handed back to your browser. This page explains what that protects and why the dashboard behaves the way it does.
Encrypted at rest
Clarify encrypts secrets with AES-256-GCM — the same class of strong, industry-standard encryption used to protect banking and government data. Each value is encrypted with a fresh random initialisation vector and carries a tamper-evident authentication tag, so a stored secret can't be silently altered.
The encryption key is operated by Clarify and rotated on our side. You don't set it, manage it or ever see it — it isn't part of your setup.
What is encrypted
Anything that could be used to act on your behalf is encrypted:
| Secret | Where it comes from |
|---|---|
| Bot token | Your own bot, when you run White Label |
| PayPal client ID & secret | Your PayPal app credentials |
| Tebex project ID, private key & webhook secret | Your Tebex store |
| Patreon access & refresh tokens | Minted when you connect Patreon |
| GitHub token | Your GitHub connection |
| Webhook signing secret | Your Webhooks module |
| Connector credentials | API keys, bearer tokens, username + password, or OAuth secrets for your Data connectors |
The dashboard never gets the value back
Once a secret is stored, Clarify redacts it on the way out. When the dashboard loads a settings page, it receives only a "stored" indicator — never the actual value. There is no way to read a saved secret back out through the dashboard.
That's why every secret field behaves the same way when you edit it:
OAuth tokens never touch your browser
When you connect a provider that uses OAuth — such as Patreon, the GitHub app, or an OAuth-based data connector — you click Connect and authorise on the provider's own site. The provider then sends the result to Clarify's servers, not to your browser.
The token is exchanged and encrypted entirely server-side. Your browser only ever sees "connected". At no point does an access or refresh token pass through the page you're looking at.
A safety net that refuses plaintext
Encryption is only useful if it can't be skipped by mistake. Clarify runs a fail-closed check before anything is written to storage: if a secret somehow reached that point still unencrypted, the save is rejected outright rather than stored in the clear.
In plain terms — there is no path where one of your secrets is saved without being encrypted first. If encryption didn't happen, the write simply fails.
In short
Encrypted at rest
AES-256-GCM on every stored secret, with a key you never have to manage.
Never returned
Saved values are redacted — the dashboard shows "stored", never the secret.
Server-side tokens
OAuth tokens are exchanged and encrypted on our servers, never in your browser.
Fail-closed
A guard rejects any write that isn't encrypted — no silent plaintext.