[{"data":1,"prerenderedAt":562},["ShallowReactive",2],{"navigation":3,"\u002Fsecurity\u002Fencryption":246,"\u002Fsecurity\u002Fencryption-surround":557},[4,30,61,96,136,171,196,226],{"title":5,"icon":6,"path":7,"stem":8,"children":9,"page":29},"Getting started","i-lucide-rocket","\u002Fgetting-started","1.getting-started",[10,15,20,25],{"title":11,"path":12,"stem":13,"icon":14},"Introduction","\u002Fgetting-started\u002Fintroduction","1.getting-started\u002F1.introduction","i-lucide-house",{"title":16,"path":17,"stem":18,"icon":19},"Add Clarify","\u002Fgetting-started\u002Fadd-clarify","1.getting-started\u002F2.add-clarify","i-lucide-bot",{"title":21,"path":22,"stem":23,"icon":24},"Dashboard tour","\u002Fgetting-started\u002Fdashboard-tour","1.getting-started\u002F3.dashboard-tour","i-lucide-compass",{"title":26,"path":27,"stem":28,"icon":6},"Quickstart","\u002Fgetting-started\u002Fquickstart","1.getting-started\u002F4.quickstart",false,{"title":31,"icon":32,"path":33,"stem":34,"children":35,"page":29},"Core concepts","i-lucide-lightbulb","\u002Fconcepts","2.concepts",[36,41,46,51,56],{"title":37,"path":38,"stem":39,"icon":40},"How Clarify works","\u002Fconcepts\u002Fhow-clarify-works","2.concepts\u002F1.how-clarify-works","i-lucide-git-compare-arrows",{"title":42,"path":43,"stem":44,"icon":45},"Tickets & delivery modes","\u002Fconcepts\u002Ftickets-and-modes","2.concepts\u002F2.tickets-and-modes","i-lucide-ticket",{"title":47,"path":48,"stem":49,"icon":50},"Categories & ticket fields","\u002Fconcepts\u002Fcategories-and-inputs","2.concepts\u002F3.categories-and-inputs","i-lucide-tags",{"title":52,"path":53,"stem":54,"icon":55},"Cards & placeholders","\u002Fconcepts\u002Fcards-and-placeholders","2.concepts\u002F4.cards-and-placeholders","i-lucide-layout-panel-left",{"title":57,"path":58,"stem":59,"icon":60},"Roles & permissions","\u002Fconcepts\u002Froles-and-permissions","2.concepts\u002F5.roles-and-permissions","i-lucide-user-cog",{"title":62,"icon":63,"path":64,"stem":65,"children":66,"page":29},"Configuration","i-lucide-sliders-horizontal","\u002Fconfiguration","3.configuration",[67,72,77,81,86,91],{"title":68,"path":69,"stem":70,"icon":71},"Onboarding","\u002Fconfiguration\u002Fonboarding","3.configuration\u002F1.onboarding","i-lucide-wand-sparkles",{"title":73,"path":74,"stem":75,"icon":76},"General settings","\u002Fconfiguration\u002Fgeneral-settings","3.configuration\u002F2.general-settings","i-lucide-settings",{"title":78,"path":79,"stem":80,"icon":50},"Categories","\u002Fconfiguration\u002Fcategories","3.configuration\u002F3.categories",{"title":82,"path":83,"stem":84,"icon":85},"Ticket inputs","\u002Fconfiguration\u002Fticket-inputs","3.configuration\u002F4.ticket-inputs","i-lucide-form-input",{"title":87,"path":88,"stem":89,"icon":90},"Panels","\u002Fconfiguration\u002Fpanels","3.configuration\u002F5.panels","i-lucide-panel-top",{"title":92,"path":93,"stem":94,"icon":95},"White label (your own bot)","\u002Fconfiguration\u002Fwhite-label","3.configuration\u002F6.white-label","i-lucide-badge-check",{"title":97,"icon":98,"path":99,"stem":100,"children":101,"page":29},"Modules","i-lucide-blocks","\u002Fmodules","4.modules",[102,106,111,116,121,126,131],{"title":103,"path":104,"stem":105,"icon":98},"Modules overview","\u002Fmodules\u002Foverview","4.modules\u002F1.overview",{"title":107,"path":108,"stem":109,"icon":110},"Transcripts","\u002Fmodules\u002Ftranscripts","4.modules\u002F2.transcripts","i-lucide-file-text",{"title":112,"path":113,"stem":114,"icon":115},"Feedback","\u002Fmodules\u002Ffeedback","4.modules\u002F3.feedback","i-lucide-star",{"title":117,"path":118,"stem":119,"icon":120},"Escalation","\u002Fmodules\u002Fescalation","4.modules\u002F4.escalation","i-lucide-siren",{"title":122,"path":123,"stem":124,"icon":125},"Opening hours","\u002Fmodules\u002Fopening-hours","4.modules\u002F5.opening-hours","i-lucide-clock",{"title":127,"path":128,"stem":129,"icon":130},"Webhooks","\u002Fmodules\u002Fwebhooks","4.modules\u002F6.webhooks","i-lucide-webhook",{"title":132,"path":133,"stem":134,"icon":135},"Assignment","\u002Fmodules\u002Fassignment","4.modules\u002F7.assignment","i-lucide-user-check",{"title":137,"icon":138,"path":139,"stem":140,"children":141,"page":29},"Integrations","i-lucide-plug","\u002Fintegrations","5.integrations",[142,146,151,156,161,166],{"title":143,"path":144,"stem":145,"icon":138},"Integrations overview","\u002Fintegrations\u002Foverview","5.integrations\u002F1.overview",{"title":147,"path":148,"stem":149,"icon":150},"Stripe","\u002Fintegrations\u002Fstripe","5.integrations\u002F2.stripe","i-simple-icons-stripe",{"title":152,"path":153,"stem":154,"icon":155},"PayPal","\u002Fintegrations\u002Fpaypal","5.integrations\u002F3.paypal","i-simple-icons-paypal",{"title":157,"path":158,"stem":159,"icon":160},"Tebex","\u002Fintegrations\u002Ftebex","5.integrations\u002F4.tebex","i-lucide-shopping-cart",{"title":162,"path":163,"stem":164,"icon":165},"Patreon","\u002Fintegrations\u002Fpatreon","5.integrations\u002F5.patreon","i-simple-icons-patreon",{"title":167,"path":168,"stem":169,"icon":170},"GitHub","\u002Fintegrations\u002Fgithub","5.integrations\u002F6.github","i-simple-icons-github",{"title":172,"icon":173,"path":174,"stem":175,"children":176,"page":29},"Data connectors","i-lucide-share-2","\u002Fdata-connectors","6.data-connectors",[177,181,186,191],{"title":178,"path":179,"stem":180,"icon":173},"Data connectors overview","\u002Fdata-connectors\u002Foverview","6.data-connectors\u002F1.overview",{"title":182,"path":183,"stem":184,"icon":185},"Build a connector","\u002Fdata-connectors\u002Fbuild-a-connector","6.data-connectors\u002F2.build-a-connector","i-lucide-wrench",{"title":187,"path":188,"stem":189,"icon":190},"Discord auto-detect","\u002Fdata-connectors\u002Fdiscord-auto-detect","6.data-connectors\u002F3.discord-auto-detect","i-lucide-scan-face",{"title":192,"path":193,"stem":194,"icon":195},"Connector security","\u002Fdata-connectors\u002Fsecurity","6.data-connectors\u002F4.security","i-lucide-shield",{"title":197,"icon":198,"path":199,"stem":200,"children":201,"page":29},"Security & trust","i-lucide-shield-check","\u002Fsecurity","7.security",[202,206,211,216,221],{"title":203,"path":204,"stem":205,"icon":198},"Security overview","\u002Fsecurity\u002Foverview","7.security\u002F1.overview",{"title":207,"path":208,"stem":209,"icon":210},"Encryption & secrets","\u002Fsecurity\u002Fencryption","7.security\u002F2.encryption","i-lucide-lock",{"title":212,"path":213,"stem":214,"icon":215},"The relay & your privacy","\u002Fsecurity\u002Fthe-middleman","7.security\u002F3.the-middleman","i-lucide-eye-off",{"title":217,"path":218,"stem":219,"icon":220},"Access & permissions","\u002Fsecurity\u002Faccess-control","7.security\u002F4.access-control","i-lucide-key-round",{"title":222,"path":223,"stem":224,"icon":225},"Data & retention","\u002Fsecurity\u002Fdata-and-retention","7.security\u002F5.data-and-retention","i-lucide-database",{"title":227,"icon":228,"path":229,"stem":230,"children":231,"page":29},"Reference","i-lucide-book-open","\u002Freference","8.reference",[232,237,241],{"title":233,"path":234,"stem":235,"icon":236},"FAQ","\u002Freference\u002Ffaq","8.reference\u002F1.faq","i-lucide-circle-help",{"title":238,"path":239,"stem":240,"icon":185},"Troubleshooting","\u002Freference\u002Ftroubleshooting","8.reference\u002F2.troubleshooting",{"title":242,"path":243,"stem":244,"icon":245},"Glossary","\u002Freference\u002Fglossary","8.reference\u002F3.glossary","i-lucide-book-a",{"id":247,"title":207,"body":248,"description":550,"extension":551,"links":552,"meta":553,"navigation":554,"path":208,"seo":555,"stem":209,"__hash__":556},"docs\u002F7.security\u002F2.encryption.md",{"type":249,"value":250,"toc":539},"minimark",[251,260,265,272,275,281,285,288,395,406,410,417,420,434,448,452,473,476,485,489,496,499,503,531],[252,253,254,255,259],"p",{},"Every sensitive value you give Clarify — a payment key, an access token, a webhook secret, your own bot token, a connector's credentials — is ",[256,257,258],"strong",{},"encrypted before it is stored",". It is never written to our database in plain text, and once saved it is never handed back to your browser. This page explains what that protects and why the dashboard behaves the way it does.",[261,262,264],"h2",{"id":263},"encrypted-at-rest","Encrypted at rest",[252,266,267,268,271],{},"Clarify encrypts secrets with ",[256,269,270],{},"AES-256-GCM"," — the same class of strong, industry-standard encryption used to protect banking and government data. Each value is encrypted with a fresh random initialisation vector and carries a tamper-evident authentication tag, so a stored secret can't be silently altered.",[252,273,274],{},"The encryption key is operated by Clarify and rotated on our side. You don't set it, manage it or ever see it — it isn't part of your setup.",[276,277,278],"note",{},[252,279,280],{},"\"At rest\" means the value is encrypted the moment it's saved and stays encrypted in storage. It's only ever decrypted in memory, on our servers, at the exact moment it's needed to talk to a provider.",[261,282,284],{"id":283},"what-is-encrypted","What is encrypted",[252,286,287],{},"Anything that could be used to act on your behalf is encrypted:",[289,290,291,304],"table",{},[292,293,294],"thead",{},[295,296,297,301],"tr",{},[298,299,300],"th",{},"Secret",[298,302,303],{},"Where it comes from",[305,306,307,322,335,347,359,371,383],"tbody",{},[295,308,309,315],{},[310,311,312],"td",{},[256,313,314],{},"Bot token",[310,316,317,318],{},"Your own bot, when you run ",[319,320,321],"a",{"href":93},"White Label",[295,323,324,329],{},[310,325,326],{},[256,327,328],{},"PayPal client ID & secret",[310,330,331,332,334],{},"Your ",[319,333,152],{"href":153}," app credentials",[295,336,337,342],{},[310,338,339],{},[256,340,341],{},"Tebex project ID, private key & webhook secret",[310,343,331,344,346],{},[319,345,157],{"href":158}," store",[295,348,349,354],{},[310,350,351],{},[256,352,353],{},"Patreon access & refresh tokens",[310,355,356,357],{},"Minted when you connect ",[319,358,162],{"href":163},[295,360,361,366],{},[310,362,363],{},[256,364,365],{},"GitHub token",[310,367,331,368,370],{},[319,369,167],{"href":168}," connection",[295,372,373,378],{},[310,374,375],{},[256,376,377],{},"Webhook signing secret",[310,379,331,380,382],{},[319,381,127],{"href":128}," module",[295,384,385,390],{},[310,386,387],{},[256,388,389],{},"Connector credentials",[310,391,392,393],{},"API keys, bearer tokens, username + password, or OAuth secrets for your ",[319,394,172],{"href":179},[276,396,397],{},[252,398,399,402,403,405],{},[256,400,401],{},"Stripe stores no key."," ",[319,404,147],{"href":148}," uses Stripe Connect — you authorise your Stripe account and Clarify only keeps a reference to the connected account, never a secret key.",[261,407,409],{"id":408},"the-dashboard-never-gets-the-value-back","The dashboard never gets the value back",[252,411,412,413,416],{},"Once a secret is stored, Clarify ",[256,414,415],{},"redacts it on the way out",". When the dashboard loads a settings page, it receives only a \"stored\" indicator — never the actual value. There is no way to read a saved secret back out through the dashboard.",[252,418,419],{},"That's why every secret field behaves the same way when you edit it:",[421,422,423],"tip",{},[252,424,425,426,429,430,433],{},"A saved secret shows as ",[256,427,428],{},"stored"," with an empty field. ",[256,431,432],{},"Leave the field blank to keep the existing value"," — only type something if you want to replace it.",[435,436,437],"field-group",{},[438,439,442],"field",{"name":440,"type":441},"Secret fields (payment keys, tokens, webhook secrets, bot token, connector credentials)","password",[252,443,444,445,447],{},"Shown as ",[256,446,428],{}," once set; the value is never displayed again. Leave blank on save to keep the current value, or enter a new value to replace it. Clearing and replacing is the only way to change a stored secret.",[261,449,451],{"id":450},"oauth-tokens-never-touch-your-browser","OAuth tokens never touch your browser",[252,453,454,455,457,458,460,461,464,465,468,469,472],{},"When you connect a provider that uses OAuth — such as ",[319,456,162],{"href":163},", the ",[319,459,167],{"href":168}," app, or an OAuth-based ",[319,462,463],{"href":183},"data connector"," — you click ",[256,466,467],{},"Connect"," and authorise on the provider's own site. The provider then sends the result to Clarify's servers, ",[256,470,471],{},"not to your browser",".",[252,474,475],{},"The token is exchanged and encrypted entirely server-side. Your browser only ever sees \"connected\". At no point does an access or refresh token pass through the page you're looking at.",[421,477,478],{"to":218},[252,479,480,481,484],{},"Each connect link is signed and short-lived, so it can't be reused or replayed. See ",[319,482,483],{"href":218},"Access control"," for how logins and permissions are protected.",[261,486,488],{"id":487},"a-safety-net-that-refuses-plaintext","A safety net that refuses plaintext",[252,490,491,492,495],{},"Encryption is only useful if it can't be skipped by mistake. Clarify runs a ",[256,493,494],{},"fail-closed check"," before anything is written to storage: if a secret somehow reached that point still unencrypted, the save is rejected outright rather than stored in the clear.",[252,497,498],{},"In plain terms — there is no path where one of your secrets is saved without being encrypted first. If encryption didn't happen, the write simply fails.",[261,500,502],{"id":501},"in-short","In short",[504,505,506,512,518,525],"card-group",{},[507,508,509],"card",{"icon":210,"title":264},[252,510,511],{},"AES-256-GCM on every stored secret, with a key you never have to manage.",[507,513,515],{"icon":215,"title":514},"Never returned",[252,516,517],{},"Saved values are redacted — the dashboard shows \"stored\", never the secret.",[507,519,522],{"icon":520,"title":521},"i-lucide-server","Server-side tokens",[252,523,524],{},"OAuth tokens are exchanged and encrypted on our servers, never in your browser.",[507,526,528],{"icon":198,"title":527},"Fail-closed",[252,529,530],{},"A guard rejects any write that isn't encrypted — no silent plaintext.",[421,532,533],{"to":144},[252,534,535,536,538],{},"Ready to connect a provider? Start from the ",[319,537,143],{"href":144}," — every connection you make is protected exactly as described here.",{"title":540,"searchDepth":541,"depth":542,"links":543},"",1,2,[544,545,546,547,548,549],{"id":263,"depth":542,"text":264},{"id":283,"depth":542,"text":284},{"id":408,"depth":542,"text":409},{"id":450,"depth":542,"text":451},{"id":487,"depth":542,"text":488},{"id":501,"depth":542,"text":502},"How Clarify encrypts your payment keys, tokens and connector credentials at rest, and why the dashboard never shows them again.","md",null,{},{"icon":210},{"title":207,"description":550},"aKnm4KnMcZ_gdZT9PbsLjK-3YFskurP5r6gWP8k9Gs4",[558,560],{"title":203,"path":204,"stem":205,"description":559,"icon":198,"children":-1},"How Clarify protects your secrets, keeps staff private, and controls who can see what.",{"title":212,"path":213,"stem":214,"description":561,"icon":215,"children":-1},"Who sees what when Clarify relays a ticket — staff stay anonymous in the forum, personal DMs stay private, and members see who helped.",1792666273350]