Security overview

This page describes how clariBI protects your account and data today, and says plainly where it stops. Report a security problem to security@claribi.com.

Signing in

• Passwords must have at least 8 characters; very common and all-numeric passwords are refused. Passwords are stored hashed.
• Two-factor authentication with an authenticator app (TOTP) and backup codes, on every plan. See Two-factor authentication.
• Google and Facebook sign-in on every plan. See Google and Facebook sign-in.
• Single sign-on through your SAML or OIDC identity provider on Enterprise, for the email domains you list. See Single sign-on with SAML or OIDC.
• Sessions use short-lived access tokens (1 hour) that renew while you are active, up to 7 days. In Settings > Security you can set an inactivity timeout (30 minutes to 24 hours, or never) and turn on an email when someone signs in from a new device.

Roles

Five built-in roles (Owner, Administrator, Analyst, Member, Viewer) made of 35 permissions, plus custom roles on Professional and Enterprise. See Roles and permissions.

Keeping organizations apart

Data sources, dashboards, reports, goals, connections, credentials and audit events all belong to one organization, and the application filters every lookup by the organization of the person or key making the request. API keys and MCP keys act only for the organization they were created in.

Encryption

• In transit: the site and the API are served over HTTPS only (TLS 1.2 and 1.3, with HSTS).
• Credentials: passwords, tokens and API keys you give clariBI to reach your data sources (API connectors, databases, Google, Meta, Atlassian and MCP apps) are encrypted with Fernet (AES-128 with an HMAC-SHA256 check) before they are stored. The encryption key is kept in the server configuration, not in the database.
• clariBI keys: your REST API keys, MCP keys and MCP tokens are stored only as SHA-256 hashes, so they cannot be read back.

We do not claim encryption at rest for the database as a whole.

AI processing

The AI features use Google Gemini, listed as a sub-processor in the privacy policy. For a question the model receives column names, a few sample values, your question and the calculated results, not your full tables. Free and Lite plans make no AI calls. See AI limitations.

MCP apps as data sources

• clariBI only calls tools that read data; tools that change data in the other app are not used.
• Connection credentials are encrypted as described above.
• Custom MCP server addresses must use HTTPS, and private network and cloud metadata addresses are refused.

Hosting and backups

• clariBI runs on DigitalOcean (listed in the privacy policy) and is deployed from our code repository.
• The database is copied to a compressed dump once a day, and the 7 most recent daily dumps are kept on the application host.
• Backups are not encrypted separately and are not copied to another location.

Deleting data

• Deleting your account deactivates it and anonymizes your personal details, and cancels any subscription you pay for. The account is not erased row by row, so the audit trail stays intact.
• Deleting an organization works the same way: it is deactivated rather than erased.
• Synced raw data older than 90 days is removed every week, except the most recent copy of each dataset.
• Removing a data source or disconnecting an MCP app deletes its stored credentials.

Audit trail

Sign-ins, user and role changes, data source changes, content changes and settings changes are recorded. Everyone sees their own activity; the organization audit trail is on Professional and Enterprise, with export on Enterprise. Events are kept 7 years by default. See Audit trail.

Certifications

clariBI does not hold SOC 2, ISO 27001 or HIPAA certification. If your data requires one of these, clariBI is not the right place for it today.

Related

• Two-factor authentication
• Roles and permissions
• Custom roles
• Audit trail
• API keys