Data and security

What Claro Historia reads, where it is kept, who can see it and how to remove it.

What we read

• Read-only. Every integration asks for read permissions only. Claro Historia never creates, changes, deletes or posts anything in your tools. The exact permissions for each tool are listed on its integration page.
• Only what you link. Connecting a tool reads nothing. Content is read only from the repositories, projects, channels, spaces and folders you link to a project.
• Personal accounts are separate. Gmail, Calendar, Outlook and Slack direct messages are used only if you connect them, are fetched on demand, and only you see them. See Personal accounts.

Who can see it

• Your workspace is separate from every other customer’s. Other companies cannot see your data.
• Inside your workspace, every member can open every project, so anything synced into a project is visible to all members, including people who could not open the original in the source tool. Link only what you are comfortable sharing with your whole workspace.
• Access to our production systems follows least privilege, requires multi-factor authentication, and is limited to the people who run the service.

Where it is stored and how it is protected

• Hosted on Amazon Web Services. Data is encrypted in transit (TLS) and at rest.
• Sign-in tokens for your connected tools are additionally encrypted with a separate key and are removed when you disconnect a tool.
• Accounts support two-factor authentication (authenticator app with recovery codes), and admins can require Google single sign-on for the whole workspace. Sessions time out after 8 hours of inactivity.
• Backups are kept for up to 14 days.

AI processing

When you ask a question, Claro Historia sends your question and the relevant content from the project to an AI model hosted by Anthropic to write the answer. Under Anthropic’s commercial API terms, this content is not used to train its models. When documents are synced, a smaller Anthropic model may read them to categorize items such as milestones and events.

Claro Historia does not use your data to train AI models, and does not sell it or use it for advertising.

Claro Historia's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Service providers

We use Amazon Web Services (hosting), Anthropic (AI processing), an email delivery provider, and the providers of the tools you connect. The full list, with what each one does and when it is involved, is on our Trust page. Our Privacy Policy describes how personal data is handled.

Assurance

• We completed Google’s security assessment (CASA), which Google requires for access to Google Drive and Gmail data, in May 2026, and it is repeated every year.
• Amazon Web Services, our hosting provider, holds SOC 2 Type II and ISO 27001 certifications. Claro Historia has not yet completed its own SOC 2 audit.

More on security practices, recovery targets and documents we can share is on the Trust page.

Disconnecting and removing data

• Disconnect a tool. Access stops immediately and the stored sign-in token is removed. Each integration page explains how.
• Remove synced content. Email support@clarohistoria.com and we will delete the content synced from a tool.
• Delete a project. Moving a project to the trash keeps it for 30 days, so it can be restored, and then deletes it permanently.
• Close a workspace. An admin can archive the workspace under Workspace Settings → Danger zone. Email us to have everything deleted.
• Your personal data. To access, export, correct or delete the personal data we hold about you, email support@clarohistoria.com from the address on your account. We respond within 30 days.

Reporting a security issue

If you believe you found a vulnerability, email security@clarohistoria.com rather than posting publicly. Please include what you found, how to reproduce it and its potential impact.

• We acknowledge reports within 2 business days and give an initial assessment within 5 business days.
• We send status updates at least every 7 days until it is resolved.
• We will not pursue legal action against researchers who act in good faith, avoid privacy violations and service disruption, only test accounts they own, and give us reasonable time to fix the issue before disclosing it.