Security & trust
Security overview
How Clarify protects your secrets, keeps staff private, and controls who can see what.
Clarify sits between your members and your team, and it handles sensitive things on your behalf: payment connections, API keys, message history and who is allowed to do what. This page is the short version of how we keep all of that safe. The pages that follow go deeper.
The short answer: your secrets are encrypted and never shown back to you, your staff stay private, and access is checked on every single request.
The eight guarantees
No plaintext secrets
Encryption
Every key, token and password you connect is encrypted at rest with AES-256-GCM. When the dashboard loads a saved integration it only ever sees a "set" marker, never the value — which is why editing a secret shows "leave blank to keep". Read more in Encryption.
Tokens minted server-side
OAuth
When you connect a provider like Patreon or GitHub, the access tokens are exchanged and encrypted on our servers. They never pass through your browser, so there is nothing sensitive to intercept.
Staff stay anonymous & private
The relay
In the team's forum thread, member messages are relayed by an anonymous webhook — your bot's internal plumbing is never exposed. And because Clarify is always the middleman, your staff never DM members from their personal accounts. Read more in The middleman.
Fail-closed encryption
Encryption
Before anything is saved, a guard checks that no secret is still in plain text. If encryption were ever bypassed it becomes a hard error — never silent storage. There is no "accidentally saved in the clear" path.
SSRF-safe connectors
Data connectors
A data connector can only reach real, public endpoints. Every request is checked against a denylist of internal and cloud addresses, redirects aren't followed, and responses are size-capped — so a connector can't be tricked into reaching somewhere it shouldn't. Read more in Connector security.
Constant-time comparisons
Access control
Security tokens — service tokens, CSRF tokens, OAuth state — are compared in constant time, so their contents can't be guessed by measuring how long a check takes.
Admin re-checked every request
Access control
Who counts as an admin is verified fresh on every request, not cached at login. Remove someone's access and it takes effect immediately. Read more in Access control.
Signed, short-lived OAuth state
OAuth
Every "Connect" flow carries a signed token that expires in about 10 minutes and is tied to your server. This blocks tampering and replay, so a connection can only ever be completed by the person who started it.
The mechanics behind these — master keys, environment configuration, infrastructure — are operated by Clarify. There is nothing for you to configure to get them, and nothing you can misconfigure to lose them.
What this means for you
- Connecting an integration is safe. Paste your key once; it's encrypted immediately and never shown back.
- Your team's privacy is protected. No one has to hand out their personal DMs to do support.
- Access is always current. Roles and permissions reflect reality right now, not who was an admin an hour ago.
- Your own systems stay walled off. Connectors reach your public API and nowhere near your internal network.
Dig deeper
Have a specific "does Clarify…?" question? The FAQ covers the common ones.