Information Security Addendum
Last updated: August 3, 2026
1. Introduction
Security is critical for Clarifi’s mission. This Information Security Addendum (the “Addendum”) describes Clarifi’s comprehensive information security program for Clarifi’s Services and Customer Information. Capitalized terms not defined in this Addendum have the meanings set forth in the MSA at https://clarifi-tech.com/legal/terms.
2. Information Security Program
Clarifi maintains an ISO 27001-compliant and AICPA SOC 2 compliant risk-based information security governance program. The framework for Clarifi’s security program includes administrative, organizational, technical, and physical safeguards reasonably designed to protect the Services and confidentiality, integrity, and availability of Customer Information.
Clarifi has adopted measures for ensuring accountability, such as implementing data protection and information security policies across the business, formally assigning roles and responsibilities for information security and data privacy functions, and periodically reviewing and updating its information security program as appropriate.
3. Access Controls
Clarifi uses secure access protocols and processes and follows industry best-practices for authentication, including Multifactor Authentication and Single Sign On (SSO). All production access requires the use of two-factor authentication, and production network infrastructure is securely configured to industry best practices to block all unnecessary ports, services, and unauthorized network traffic.
4. Device Security
Corporate devices that process Customer Information are centrally managed and are equipped with mobile device management software and anti-malware protection, with security configurations such as disk encryption, screen lock configuration, and software updates enforced. Endpoint security alerts are monitored with 24/7/365 coverage.
5. Awareness and Training
Clarifi provides comprehensive security training to all employees upon onboarding and annually through educational modules using the Vanta compliance platform. In addition, all new employees attend a mandatory onboarding session centered around key security principles. All new engineers also attend a mandatory onboarding session focused on secure coding principles and practices.
6. Data Encryption
Clarifi has deployed secure methods and protocols for transmission of confidential or sensitive information over public networks. Clarifi uses recommended secure cipher suites and protocols to encrypt traffic in transit (i.e. TLS 1.2).
Databases housing sensitive Customer Information are encrypted at rest at a minimum of two layers. Clarifi uses only recommended secure cipher suites and protocols to encrypt all traffic in transit and at rest. Clarifi has controls in place for encryption-at-rest using industry standard AES-256 encryption to secure volume (disk) data and for key management.
7. Deletion of Customer Information
During the term of the Agreement, Customer may delete Customer Information using the self-service functionality available within the Services. Following the effective date of termination or expiration of a Customer’s agreement for the Services, Clarifi will delete Customer Information by expunging such Customer’s unique instance of the Clarifi Services within 365 days, or earlier upon request.
8. Customer-Configurable Security Controls
Clarifi provides a variety of configurable security controls that allow Customer to manage and protect its own use of the Services, including SSO authentication for administrative and user access and role-based access controls and permissions for access to resources. Customer is responsible for appropriately configuring such controls taking into account the nature of its Customer Information.
9. Incident Response
Clarifi maintains an incident response plan with measures to be followed in the event of any breach of security that causes the unlawful or accidental destruction, alteration or damage or loss, unauthorized disclosure of, or access to, Customer Information. Such measures include prompt investigation and notification of Customer in accordance with the Agreement and DPA.
10. Penetration testing
Clarifi engages a third party to conduct penetration testing at least annually. All areas of the Clarifi product and cloud infrastructure are in-scope for these assessments. A summary of the most recent penetration testing report is available upon request.
11. Bug Bounty Program
Clarifi engages a third party to manage a vulnerability disclosure program as well as a private bug bounty program. All valid issues identified are handled according to our vulnerability management program.
12. Vulnerability Management
Clarifi maintains a vulnerability management program that includes regular network scanning and scanning at key stages of Clarifi’s secure development lifecycle and remediation of vulnerabilities on a risk basis in accordance with internal SLAs.
13. Backups
Daily, weekly and monthly backups of production datastores are taken. Backups are periodically tested in accordance with information security and data management policies.
14. Sub-processors
Clarifi conducts reasonable diligence and security assessments of Sub-processors using a risk-based approach. Clarifi enters into Data Processing Agreements with its Sub-processors with data protection obligations substantially similar to those contained in the DPA.
15. Audits and certifications
Clarifi conducts regular third-party audits to ensure compliance with our privacy and security standards, including but not limited to annual SOC 2 Type II and ISO 27001 audits. Clarifi’s SOC 2 Type II audit includes the Security, Availability, and Processing Integrity Trust Service Criteria. Clarifi’s privacy controls as a Data Processor are certified to ISO 27701. AI Risk Management processes are certified to ISO 42001.
16. Physical security
Clarifi has reasonable controls in place to ensure the physical locations that process, store, or transmit Customer Information are appropriately secured. Clarifi’s hosting and cloud infrastructure is provided by Microsoft Azure, AWS, and GCP, housed in physical data centers managed by those providers.
17. Logging and Monitoring
Clarifi monitors access to applications, tools, and resources that process or store Customer Information, including cloud services. Monitoring of security logs is managed by the security and engineering teams. Log activities are investigated when necessary and escalated appropriately.
18. Change and configuration management
Clarifi adheres to a change management process to administer changes to the production environment for the Services, including changes to its underlying software, applications, and systems. All production changes are automated through CI/CD tools to ensure consistent configurations.
19. Data Integrity and Management
Clarifi’s Customers unilaterally determine what Customer Information they route through the Services. As such, Clarifi operates on a shared responsibility model.
Clarifi has a multi-tiered approach for ensuring data quality. These measures include: (i) unit testing to ensure quality of logic used to process API calls, (ii) database schema validation rules which execute against data before it is saved to our database, (iii) a schema-first API design using strong typing to enforce a strict contract between official clients and API resolvers. Clarifi applies these measures across the board, both to ensure quality and that the Clarifi Services are operating within expected parameters.
20. Updates
Clarifi may update or modify this Addendum from time to time, provided that such updates and modifications do not materially reduce the overall security of the Service.
Questions about this Addendum? Contact [email protected].