What we do
- Read-only on your Stripe account. Clue asks Stripe for read permissions only. It cannot change anything in your account.
- Every request is verified. Each request from the Stripe Dashboard is signed by Stripe, and we check the signature before doing anything. Your account is identified only from that signature.
- Each merchant's data is kept separate. Stored lookups and synced data are held per Stripe account and are never served to another merchant.
- Encrypted, in the United States. Data is encrypted in transit and at rest, on Amazon Web Services in the United States.
- Less data to the AI model. The model that writes Clue's summary never receives raw email addresses, phone numbers, IP addresses or licensed record values, and it cannot set the verdict.
- Deletion on uninstall. What we delete and when is set out in the Privacy Policy. The services that receive data are listed on the sub-processors page.
Report a vulnerability
Email support@gocanonical.com with "Security" in the subject. Include the steps to reproduce the issue and what you think its impact is.
While testing, please do not access or change data that isn't yours, do not degrade the service for others, and give us reasonable time to fix the issue before you disclose it.
Our contact details for security reports are also published at /.well-known/security.txt.