Where applicant data lives and who sees it.

This overview sums up how Klarefi ("Klarefi") secures its service: hosted intake, document upload, the operator workspace, the agent that reads documents and runs checks, the audit trail and the admin controls.

It is written for security and procurement review. Read it together with your customer agreement, your order form and the data processing agreement. Some controls depend on your plan, your settings or how Klarefi is deployed for you.

Klarefi secures the application and the services it runs: sign-in, permissions, logging, the workflow engine and the audit trail. We keep the code and its dependencies maintained, and we respond to incidents on the systems we control.

You decide what your intake collects, how its workflow and checks are set up, who in your team has access, how long data is kept where you can set it, and where a person reviews before anything is sent. The business and regulated decisions stay with you.

Your team signs in to the dashboard through WorkOS. Enterprise agreements can add single sign-on with SAML or OIDC, and directory sync to add and remove people from your identity provider. Which sign-in features you have depends on your plan.

Every user belongs to an organisation and holds one or more roles: admin, operator, developer or billing admin. Each role opens only the parts of Klarefi it needs, such as cases, workflows, privacy requests, API keys or billing. Keeping your user list current, including removing people who leave, is your part.

All traffic to Klarefi uses TLS, and browsers are told never to connect over plain HTTP. API keys are stored only as SHA-256 hashes. Documents and extracted data are encrypted at rest by our EU hosting platform. Connector and webhook secrets are also encrypted with AES-GCM by Klarefi itself, and backups with AES-256-GCM before they leave our infrastructure.

This overview does not go into cipher suites or key management in more detail. Ask us if your review needs them.

Every change passes automated tests before it is deployed. Klarefi validates input, checks permissions before data is read or changed, and only lets a case move through the steps its workflow allows.

The agent that reads documents works through a fixed set of tools in a sandbox, not with open access to our systems.

The hosted service runs on Railway in the EU: the web app, the database, the document workers and document storage. The AI model that reads documents runs through OpenRouter, at model providers in the US and other countries. Backups are also kept away from Railway, on Cloudflare R2. The full list of providers and where each one works is on the subprocessors page.

We keep records of sign-ins, setting changes, uploads and submissions, workflow steps, usage for billing, and errors. We use them to support you, fix problems, prevent abuse and bill correctly.

Service monitoring goes to Axiom in the EU and is limited to a fixed list of operational fields. It carries no applicant details, document names, case content or extracted values.

Every case keeps its own audit trail: submissions, uploads, questions to the applicant, checks and every action your team takes, each with its time. Nobody can edit it. It is deleted only when the case's retention period ends or an applicant's data is erased on request.

Every record belongs to one organisation, and the service is built so one customer cannot read or query another's. Each organisation also has separate test and live environments. The exact setup depends on how Klarefi is deployed for you, and your agreement sets out what we commit to.

When we suspect a security incident on systems we control, we find it, contain it, fix it and follow up. Where the law or your agreement requires it, we tell you. Notice periods are the ones in your agreement or DPA.

Every night the database and every applicant document are backed up, encrypted with AES-256-GCM, and copied to a separate Railway bucket and to Cloudflare R2. Backups are kept for 30 days. Our target is to lose at most 24 hours of data and to be running again within four hours.

We only count a backup as working once a restore from it has been tested. Recovery commitments for your account are the ones in your agreement.

We keep dependencies up to date and fix security issues in order of how severe and how exposed they are. There is no public bug bounty, formal penetration test programme or fixed time to fix yet. If you find a problem, write to us at the address in section 17.

A short list of providers runs parts of the service: hosting, storage, AI, sign-in, billing and email. Each one, what it handles and where, is on the subprocessors page, where changes are posted first. Each is bound by data protection terms at least as strict as our data processing agreement, which also sets out how you can object to a change.

Klarefi uses AI to read documents, take out facts, find what is missing and run your checks. AI can be wrong. That is why every fact keeps its source, a fact Klarefi cannot find is marked missing instead of guessed, and a check that is not met stays visible in the file.

The model runs through OpenRouter, in the US and other countries, and only at providers that keep no copy of the data. It receives the document text and page images it reads, and we do not allow it to use them to train models. On an enterprise agreement the AI can run through your own model account instead, in a region you choose.

You decide where a person reviews before anything is sent, and whether the result fits your legal and regulatory duties.

You choose what your intake asks for, set up its workflow and checks, give your team the right roles and remove access when people leave. You also manage your single sign-on settings, decide where a person must review before acting, and check the systems Klarefi sends files to.

Send security questions and vulnerability reports to security@klarefi.com. Our security.txt is at /.well-known/security.txt.

No software connected to the internet can promise perfect security, perfect uptime or that every automated result is right. Results also depend on your settings, your team and your providers.

This overview is for information. It does not change your agreement, DPA or order form. Lending, underwriting, claims and other regulated decisions stay with you and your team.