Trust
How Claro Historia protects your data, who handles it, and how to get the documents your security review needs. Last updated October 2026.
Security at a glance
| Read-only by design | Every integration asks for read permissions only. Claro Historia never creates, changes, deletes or posts anything in your tools, and reads nothing until you link a repository, channel, space or folder to a project. |
| Encryption | Data is encrypted in transit (TLS) and at rest. Sign-in tokens for your connected tools are additionally encrypted with a separate key and are removed when you disconnect a tool. |
| Workspace isolation | Each workspace is separate from every other customer’s, and every request is checked against the signed-in user’s workspace. |
| Sign-in | Two-factor authentication (authenticator app with recovery codes), optional Google single sign-on enforced for the whole workspace, a temporary lockout after repeated failed sign-ins, and sessions that expire after 8 hours of inactivity. |
| Personal data you opt into | Email, calendar and direct messages are fetched on demand, are visible only to the person who connected them, and are never added to a project. |
| Secure development | Automated dependency, secret and code scanning runs on every code change, container images are scanned, and a daily check opens fixes for vulnerable dependencies. |
| Production access | Follows least privilege, requires multi-factor authentication, and is limited to the people who run the service. |
The full explanation, including who can see what inside a workspace, is on Data and security.
Compliance and assurance
- We completed Google’s security assessment (CASA), which Google requires for access to Google Drive and Gmail data, in May 2026, and it is repeated every year.
- Amazon Web Services, our hosting provider, holds SOC 2 Type II and ISO 27001 certifications. Claro Historia has not yet completed its own SOC 2 audit.
Claro Historia's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Data handling
- Where it lives. Hosted on Amazon Web Services.
- AI processing. Questions and the relevant project content are sent to an AI model from Anthropic to write answers. Under Anthropic’s commercial API terms, this content is not used to train its models. Claro Historia does not use your data to train AI models, sell it, or use it for advertising.
- Backups and recovery. Backups are kept for up to 14 days. Our recovery targets: restore service within 4 hours, with at most 24 hours of data lost.
- Retention and deletion. Deleted projects stay in the trash for 30 days, then are permanently deleted. Application logs are kept for 30 days. You can disconnect a tool at any time, and we delete synced content on request.
- Your rights. To access, export, correct or delete your personal data, email support@clarohistoria.com from the address on your account. We respond within 30 days.
Subprocessors
These companies process customer data on our behalf. We update this page, and email workspace admins, before a new one starts handling customer data.
| Provider | What it does | Data involved | When |
|---|---|---|---|
| Amazon Web Services | Hosting, database, file storage, backups and encryption keys | All customer data, encrypted | Always |
| Anthropic | AI model that answers questions and reads documents when they sync | Your questions and the project content relevant to them | When you use the chat or document syncing |
| Postmark | Sends email: invitations, password resets, trial notices | Recipient email address and name, workspace name | Always |
| Sign in with Google; Google Drive, Gmail and Calendar | Sign-in email; content you link or let the AI use | Only if you use Google sign-in or connect a Google account | |
| Microsoft | OneDrive, Outlook and Teams | Content you link or let the AI use | Only if you connect a Microsoft account or Teams |
| GitHub | Source code hosting | Pull requests, issues and commits you link | Only if you connect GitHub |
| Atlassian | Jira, Confluence and Bitbucket | Issues, pages and pull requests you link | Only if you connect an Atlassian tool |
| Slack | Team messaging | Messages in channels you link; your own direct messages if you opt in | Only if you connect Slack |
| Linear | Project management | Cycles, projects and issues you link | Only if you connect Linear |
| GitLab | Source code hosting | Issues, merge requests and milestones you link | Only if you connect GitLab |
| Notion | Notes and wikis | Pages and databases you share | Only if you connect Notion |
Documents on request
For a security review or procurement questionnaire, email support@clarohistoria.com. We reply within 2 business days. Available on request:
- Our written security policies: information security policy, acceptable use policy, risk assessment policy, change management policy, security awareness training
- A Data Processing Agreement (DPA)
- Answers to your security questionnaire
Incidents and vulnerability reports
- If an incident affects your data. We notify the affected customers when their confidential data is confirmed or reasonably likely to have been exposed, with what happened, what data was involved, what we have done and what you should do.
- Found a vulnerability? Email security@clarohistoria.com. We acknowledge reports within 2 business days. See how we handle them.
Contact
Security and document requests: support@clarohistoria.com. Vulnerability reports: security@clarohistoria.com. Our Privacy Policy and Terms of Service describe how personal data is handled and the terms of use.