How Clor keeps your data safe

What we do today, described plainly. Nothing on this page is a plan.

Each company kept apart: Every company’s records carry its identity, and the database itself refuses a query that does not name the company it is for. A mistake in one screen cannot show one company another’s data.
Sign-in: Passwords stored only as strong hashes, lockout after repeated failures, authenticator apps, and single sign-on with your own identity provider.
A second check for what matters most: Closing a company, opening payroll figures and changing bank details can need a fresh authenticator code or a second person’s approval.
Who did what: Changes to records, roles and access are written to an audit trail in plain words, with who made them and when.
Keys and tokens: API keys and connector tokens are stored only as hashes, can be paused, rotated or revoked, and expire.
Where it runs: Google Cloud, Mumbai region, served through Cloudflare.
Your data is yours: Export a company’s data at any time. Closing a company gives a notice period before anything is deleted.

Found a problem?

If you believe you have found a security issue in Clor, write to us. We read every report.