How clausebench handles your data

Documents

Public documents download directly, without a form.

• Data processing agreementOpen
• Privacy policyOpen
• Cookie policyOpen
• Sub-processor listOpen
• Retention scheduleOpen
• Security overviewOpen
• Record of processing activitiesRequest
• Information security policies (full)Request
• CAIQ Lite (Cloud Security Alliance)On requestAnswered on request: we fill in your copy of CAIQ Lite v4.1 from our published documents with our own questionnaire tool. Our answers to all 138 questions are prepared, including the ones that are a plain "no". The CSA licence does not allow the questionnaire itself to be republished, so it is not posted here.
• SIG Lite (Shared Assessments)On requestWe complete your copy on request. SIG is licensed by Shared Assessments, so we answer the one you send rather than publish our own.

Who we are

• clausebench is operated by REALTY.TM GROUP sp. z o.o., Kraków, Poland (KRS 0001219891), a company established in the European Union.
• Because the operator is established in the EU, no representative under Article 27 GDPR is needed.
• Each firm is the controller of its clients' data; clausebench processes it on the firm's behalf as processor; our model provider acts as sub-processor.
• clausebench prepares documentation and does not provide legal services.
• Requests about personal data go to privacy@clausebench.com.

Data

• Client data at rest is stored in the Supabase project region eu-west-1 (Ireland).
• The application runs in our own containers on a server in Frankfurt, Germany (fra1).
• Data is encrypted in transit with TLS. At rest it is encrypted by our database and storage provider as part of their platform; we have not audited that ourselves.
• Product analytics are our own events in our database, with no third-party analytics service and no document or interview content in them.
• Our website sets no optional cookies before consent.
• Prompts and model answers are not written to application logs. What is recorded per call is the model, the token counts, the cost and whether it succeeded.
• We do not process special categories of personal data. What a workspace holds is facts about companies and their vendors, not health, biometric or similar data about people.
• The product is sold to businesses and we do not knowingly process data about children.
• Our customers are in the EEA, the United Kingdom and North America.
• When a subscription ends the workspace becomes read-only and its data is kept: it is a practice's working archive, and an engagement that resumes finds it where it was left. Nothing is deleted on a timer. It is deleted when the customer asks, within 30 days of confirming the request.
• Logs are kept 90 days. Product events, which carry no personal data, are kept 25 months and the demo workspace's 30 days.
• Support correspondence is kept 365 days.
• Incident records and the log of data subject requests are kept five years.
• When one of our policies changes, every user is told by a notification in the product, sent automatically when the change goes live, and the revised policy is published on the website with the date it changed.
• Transfers from the UK: to Stripe and Anthropic (Ireland) under the UK adequacy regulations for the EEA; to Supabase (Singapore) under the UK Addendum to the EU Standard Contractual Clauses; to Resend (United States) under the UK Extension to the EU-US Data Privacy Framework and the UK Addendum.
• Invoice and payment records are kept five years, as accounting and tax law require. Everything else about a closed account is deleted as described above.
• Data about people who are not customers. A free website check — the addresses entered and, where the result was asked for by email, that address — is deleted 90 days after the check, and a request to exclude a domain that was never confirmed is deleted after 7 days. An address left on the website for a download or a result, and the outreach register — the company, the role address it publishes for questions of this kind, the report and the letters sent — are kept until the person asks, and then erased within 30 days of the request being confirmed (owner, 2026-09-29). Nothing there is deleted on a timer. One click on a letter already deletes the report. What is kept is the record that this address or domain is not to be written to again: it is the only thing that keeps that promise.

Model provider

• Documents, interview replies and questionnaire answers are drafted with the Anthropic API.
• Our model provider keeps nothing of what we send: on the Claude API the prompts and answers are not retained by default, and none of the models we use are the ones that require 30-day retention. We do not hold a separate zero data retention agreement, so this rests on the provider's published policy rather than on a contract of our own.
• Our model provider does not use the data we send to train models.

Security

• Staff access to the internal admin requires a second factor.
• Every way into production data through clausebench needs a second factor: each admin screen, each staff endpoint and each staff action refuses a session that has not passed one.
• Everyone who can sign in to the accounts that hold our infrastructure — the database provider, the server provider and the code host — uses a second factor.
• Development runs against a local database. The application refuses to start in development against any database that is not local, unless the person starting it sets ALLOW_CLOUD_DEV for that run.
• Every change is reviewed by a second person, and runs the full test suite, type checking, linting and a container build, before it can be deployed.
• An incident response procedure exists, with an incident officer reachable at incident@clausebench.com.
• Access to production is logged: every staff action in the admin with who, when and from where; every support session with the screens opened; every sign-in to a workspace.
• Backups are taken daily, weekly and monthly and kept 90 days, in the same region as the database. A restore has been tested, so at most one day of data could be lost. Only technical support can start a restore.
• We do not hold SOC 2 or ISO 27001 certification and have not had an external penetration test yet.
• Penetration testing is planned monthly; a start date has not been set.
• When someone leaves, their account is closed and blocked in every service on their last day.
• Devices used to reach production run an access-control tool.
• Security and privacy policies are reviewed every quarter.
• The application is rebuilt from the repository by the deploy pipeline and started on the server with docker compose; the server's environment file is kept apart from the deploy, so a redeploy cannot overwrite it.
• A full disaster-recovery test — containers, data and a check that the service works — is planned monthly. It has not been carried out yet.
• Service is restored within one day by the support team.
• A standby copy of the data and the code is kept.
• New vendors are approved by the CTO.
• Vendors are reviewed once a year by the CTO or the CEO.

Sub-processors

The complete list of services that process client data for us. We announce a new sub-processor at least 30 days before it takes effect.

Legal entity, country, transfer mechanism and DPA come from our vendor registry, checked against each vendor's own pages.