Your workspace holds your customer list, their addresses, your prices and your margins. This page describes, in plain terms, how that information is protected — and, just as importantly, what we do not claim.
Passwords are stored as bcrypt hashes and never in readable form. Repeated failed sign-in attempts temporarily lock the account. Password reset links are single-purpose, short-lived, and stored hashed so a database copy cannot be used to take over an account.
Each request is authorised by a short-lived token, refreshed from a server-side session that can be revoked. Sessions record the date, IP address and browser used, which is what makes an unexpected sign-in visible after the fact.
Every record belongs to one company, and every query is scoped to the company of the signed-in user. Reaching another company’s clients, jobs or documents is not a matter of hiding a button: the data is never selected in the first place.
Owners, managers and field employees see different things. A field employee sees the jobs assigned to them, not your revenue or your subscription. Sensitive actions such as billing are restricted to the account owner on the server, not only in the interface.
Card details are entered on a Stripe-hosted page and never reach our servers, so there is no card number to steal from us. The payment provider credentials we store are encrypted with AES-256-GCM.
Significant actions are recorded with who did what and when, and authentication events also record the IP address and browser. When something looks wrong in an account, that trail is what allows an answer rather than a guess.
Uploaded files must be images, are checked against their actual content rather than their file name, and are size-limited. HTML you edit in the Document Studio is sanitised before it is stored, so a document cannot become a way to run code in someone else’s browser.
When a document is signed, we store a fingerprint of the signed content along with the signer, date, IP address and browser. A signed document that is later altered no longer matches its fingerprint, and once signed it cannot be reopened for editing.
A security page that only lists strengths tells you nothing. These are the limits we know about today. If one of them matters for your business, say so — it helps us prioritise.
If you believe you have found a security issue, email support@cleamano.com with the steps to reproduce it. Please give us a reasonable opportunity to fix the issue before disclosing it publicly, and avoid accessing data that is not yours while testing. We will confirm receipt and keep you informed.