Security

Claroo reads. It does not transact, it does not custody assets, and it collects the minimum it needs to build coverage of the securities you tell it you own. The most sensitive thing we hold is a list of your positions, and the most important control we have is that we never hold anything that would let someone act on them.

This is the section that matters most, so it is first and it is specific.

• Connections are read-only. Trading scopes are never requested, at any tier, for any account.
• Claroo never receives or stores brokerage credentials. Authorisation is handled entirely by SnapTrade or Plaid; what we receive is a scoped access token.
• Access tokens are encrypted at rest and are revocable by you at any time, in one click, from Settings.
• What we can see: positions, cost basis, and transaction history. What we cannot do: place an order, move cash, change account settings, or take any other action.

TLS 1.2 or higher in transit, enforced by HSTS with preload. AES-256 at rest. Secrets and access tokens are held in managed secret storage rather than in application configuration.

Least privilege by default. SSO and MFA are required on internal tooling. There is no routine engineer access to customer portfolio data; access for support or debugging is explicit, time-bounded and logged.

Passwords are hashed with a memory-hard algorithm. Sessions are short-lived and revocable.

• Document text ingested from filings, transcripts and news is untrusted input. It is processed as data and is never permitted to act as instruction to the system.
• Generated output is constrained to retrieved spans, and every factual claim is verified against its cited span before publication.
• Customer data is not used to train third-party models.
• Prompts and retrieved context are scoped per tenant; one account’s documents cannot enter another account’s retrieval.

Portfolio data is separated per tenant, and every query path carries the tenant identifier. Public filing text is shared infrastructure, because it is public.

The same list appears on the Privacy page. Keep them in sync.

Changes go through review before merge. Dependencies are scanned for known vulnerabilities. Secrets are never committed — the repository ignores every .env variant except the example file. Type checking, linting and a production build all gate deployment.

We monitor for anomalous access and failed authorisation. If an incident affects your data we will tell you what happened, what we know, and what we are doing about it.

Email security@clarooai.com. We acknowledge within 24 hours and will keep you updated until it is resolved. We will not pursue legal action against good-faith research that respects user data and does not degrade the service for others.

Delete your account from Settings and everything associated with it — holdings, generated briefs, questions, alert rules — is deleted within 30 days, permanently. Brokerage tokens are revoked immediately on disconnect. Billing records are retained only as long as tax and accounting rules require.