Your clients trust you. You can trust Clara. Security, privacy and governance are built into every module, not bolted on.
Built for regulated businesses.
Clara is used by financial advisers, brokers and businesses that hold sensitive client information. These are the commitments we make about it.
What is in place today.
We only list a control as in place once it is built and running in production. Planned work is marked as planned.
| Area | Control | Status |
|---|---|---|
| Access | Role-based access: every user gets explicit module grants (no grant, no access) | In place |
| Access | Record-level scoping by product line, client owner and request owner | In place |
| Access | Client portal fully separated from staff routes; one-time-code login | In place |
| Data | Dedicated database per organisation (tenant isolation by project) | In place |
| Data | Encryption in transit (TLS) and at rest | In place |
| Data | Integration secrets stored in an encrypted vault, write-only from the app | In place |
| Data | Clients archived, never hard-deleted, so linked records survive | In place |
| Change | Database-level audit trail on policies, clients, orders, invoices, payments and more | In place |
| Change | Versioned, staged schema rollouts (dry run, canary, then fleet) | In place |
| Change | Peer and automated code review before every release | In place |
| Operations | Payments, accounting writes and client sends run only after an approval sign-off | In place |
| Operations | Signed and replay-checked inbound webhooks | In place |
| Assurance | Ongoing internal penetration testing programme | In progress |
| Assurance | Independent third-party penetration test | Planned |
| Assurance | ISO 27001 / SOC 2 alignment | Planned |
How we keep your data safe.
Infrastructure
Clara runs on managed cloud infrastructure (Vercel and Supabase). Each organisation gets its own Supabase database, so your data is never mixed in a shared table with another customer.
Application security
Every API route checks who you are and what you are allowed to see on the server. Data access goes through shared, tested helpers rather than ad hoc queries, with automated checks in CI.
Audit logging
Inserts, updates and deletes on core records are captured by database triggers, whatever path made the change: the app, an import, a sync or an automation.
Secrets management
API keys and passwords for your connected systems (Xero, Sage, email, storage) are encrypted in a vault. Once saved they cannot be read back through the app.
Human in the loop
AI agents prepare work; people approve it. Money movements, accounting writes and client-facing messages only run after a named person signs off.
Resilience
Managed, encrypted backups through our database provider, with point-in-time recovery available on production databases.
South African privacy law, built in.
Clara is built in Cape Town for businesses that answer to the Protection of Personal Information Act.
Read the full POPIA Statement →
Our role
For data you load into Clara, your organisation is the responsible party and xlabs acts as your operator under POPIA section 21, processing only on your instructions.
Information Officer
Our Information Officer oversees POPIA compliance and handles access, correction and deletion requests at info@xlabs.co.za.
Data residency
Hosting and databases currently run in the European Union. Information leaves South Africa only under POPIA section 72 safeguards.
Breach notification
If a security compromise affects your data, we notify you without undue delay so you can meet your own obligations to the Information Regulator and data subjects.
Data subject rights
Records can be found, exported, corrected and archived, so you can respond to data subject requests from inside the platform.
Retention & deletion
On termination you can export your data. We then delete your organisation's database in line with our agreement with you.
AI that works for you, not on you.
- Your data is never used to train models shared with other customers.
- You choose the AI provider and set a monthly budget for your organisation.
- Requests to AI providers are made through their business APIs, which do not train on submitted data.
- Every answer the assistant gives is scoped to what the asking user is allowed to see.
- AI drafts are drafts: nothing is sent to a client or paid out without a person approving it.
Who helps us run Clara.
Each provider is bound by contract to protect your data. We give customers notice before adding a new subprocessor.
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, file storage and encrypted secrets | European Union |
| Vercel | Application hosting and delivery | European Union |
| Resend | Bulk and transactional email delivery | United States |
| AI service providers | AI processing; receive only the content needed and may not train on it | Per provider |
| Your chosen integrations | Accounting system, Google, Slack or WhatsApp, only if you turn them on | Per provider |
Policies and documents.
Public documents open directly. Others are shared with customers and prospects on request, usually under NDA.
Controls
Security controls overview
On requestThe control set on this page, in detail, with how each is implemented.
Request access →Clara application security assessment
AvailableScope, method and outcome of our latest security testing. v1.0, 21 Oct 2026.
View →Security questionnaire (CAIQ-lite)
In preparationPre-filled answers to the questions procurement teams ask most.
Security
Information Security Policy
On requestHow we protect information, assign responsibility and manage risk.
Request access →Access Control Policy
AvailableLeast-privilege access, MFA, joiners/movers/leavers and reviews. v1.2, 22 Oct 2026.
View →Incident Response Plan
AvailableHow we detect, contain, notify and learn from incidents. v1.1, 21 Oct 2026.
View →Business Continuity & Backup
AvailableBackups, recovery objectives and continuity arrangements. v1.1, 21 Oct 2026.
View →POPIA & privacy
POPIA Statement
AvailableHow Clara meets the eight POPIA conditions, our operator role, transfers and your rights. v1.0, 21 Oct 2026.
View →Operator Agreement (DPA)
On requestPOPIA section 21 operator terms, also covering GDPR where it applies.
Request access →Terms & conduct
Master Subscription Agreement
On requestThe terms that govern your use of the Clara platform.
Request access →Acceptable Use Policy
AvailableWhat the platform may and may not be used for. v1.1, 22 Oct 2026.
View →Code of Conduct
AvailableThe standards our team holds itself to, including confidentiality. v1.1, 22 Oct 2026.
View →Found a security issue?
Tell us. We investigate every report, keep you updated, and won't take action against good-faith research that avoids harm to our customers' data.
Email info@xlabs.co.za with a description of the issue, the steps to reproduce it and any proof of concept. Please don't access, change or delete data that isn't yours, and give us reasonable time to fix the issue before sharing it publicly.
Need more for your compliance team?
We'll walk your team through our controls and share the documents you need.