Your data is
safely protected.
We protect your most sensitive credentials and data, and here's exactly how we do it.
Encrypted at every layer, always
Your credentials never sit in plaintext. Every secret is sealed before it touches disk, and connections are encrypted in transit.
- AES encryption for credentials, tokens, and API keys at rest
- Encryption keys derived from environment variables, never stored alongside data
- TLS encryption on every connection — OAuth flows, API calls, webhook deliveries
You control who gets in
Every integration connects through scoped OAuth — not raw credentials. You decide what each tool can access, and you can revoke it at any time.
- OAuth 2.0 flows with scoped and revocable tokens
- Integration-level access control — tools are only available when you explicitly connect an integration
- Row-level security via Supabase RLS — your data is fully isolated, no cross-account leakage
Safe inputs, validated outputs
Before anything reaches the AI model, it passes through multiple layers of validation. Injections are detected, inputs are sanitized, and model routing is restricted to a trusted allowlist.
- Real-time injection detection — XSS, SQL injection, and template injection patterns caught and blocked
- Input sanitization — trimmed, length-capped, null-byte stripped, and unicode-normalized before processing
- Model and provider validation against an allowlist — no arbitrary model routing
Monitored by default
Security is not a feature you toggle. It runs in the background on every request — security event logging and input sanitization are always on.
- Security event logging with timestamps, sanitized details, and severity levels
- Automatic PII redaction in security logs — emails, phone numbers, and secrets masked
- Suspicious input detection — prompt injection and exfiltration patterns flagged in real time
Built for teams that take data seriously
Your data is yours. We do not sell it, share it, or use it to train models. Data deletion is available on request.
- Google API User Data Policy compliant — Limited Use, no advertising, no resale
- No training on your data — your workflows are yours alone
- Data deletion available on request — contact support to have your data removed
- Privacy-focused by design — minimal data collection, purpose-limited processing
Frequently asked
questions
Is my data used to train AI models?
No. Your data is used exclusively to operate your workflows and is never shared with or used to train any AI model provider.
What happens when I delete my account?
Contact support at support@clawfast.com to request full data deletion. We will remove your credentials, conversation history, and workflow configs.
Can ClawFast access my tools without permission?
No. Every integration requires explicit OAuth authorization. You control which tools are connected and can revoke access at any time.
How are API keys stored?
API keys are encrypted with AES before storage. The encryption key is held in environment variables, never alongside the encrypted data.