Trust and Security
How we protect the data your business runs on.
ClayGen builds, hosts, and runs software that holds your operational data. Here is how we keep it secure, private, and available, and who we work with to do it.
Last reviewed: September 2026.
Hosting and data residency
Your ClayGen Connect application and its primary database run on Amazon Web Services in Canada (the Canada Central region). Your core operational data is stored in Canada. Some of the services we rely on to deliver features (listed below) operate outside Canada. Where that is the case, we limit what is shared to what the feature needs.
Encryption
Data is encrypted in transit with TLS, and at rest on encrypted storage. Sensitive fields are additionally encrypted at the application layer.
Access and isolation
Access is role-based and protected with multi-factor authentication. Each customer organization's data is isolated from every other customer's. One customer can never see or query another customer's data.
AI governance
AI features run on approved providers, configured so your business data is not used to train public models. Each organization's AI context stays isolated to that organization. We monitor cost, usage, and quality.
Backups and availability
We take regular backups and test recovery. The platform has automated monitoring around the clock, with defined escalation and response coverage.
Privacy and compliance posture
ClayGen Connect is designed to align with Canadian privacy law, including PIPEDA and, for health information, PHIPA. Alignment is not the same as certification, and we do not claim a formal certification we do not hold. We maintain the controls and documentation that support your own compliance obligations.
Key subprocessors
| Provider | Purpose |
|---|---|
| Amazon Web Services (Canada) | Application hosting, database, and storage |
| Cloudflare | File storage and network security |
| Clerk | Authentication and identity |
| Microsoft 365 | Email and productivity integration, where you connect it |
| Anthropic and OpenAI | AI model providers for AI features |
| Stripe | Payment processing |
| Resend | Transactional email |
| Upstash | Caching and rate limiting |
| Google Analytics | Website analytics on our marketing site |
This lists the key subprocessors that may handle customer or personal data. A current, complete list and our data processing terms are available on request.
Your data and your rights
You can request a data processing agreement, a copy of your data, or deletion of your data. See our Privacy Policy and our Data Deletion page, or contact us.
Have a specific security requirement?
Book an Operations Walkthrough and we will walk you through how we would handle it.
Book an Operations Walkthrough