Security

Last updated: July 2026

Scope

This page covers the security measures applied to all Cladior-operated infrastructure: www.cladior.com, cladior.com, and all supporting backend services. It does not cover Developer-built products that integrate the Cladior SDK. Security responsibilities for those products remain with the Developer.

Encryption and transport

All data in transit between clients, the Cladior edge, and our servers is encrypted using TLS 1.2 or higher. No plaintext traffic is accepted or transmitted at any point in the stack.

Authentication and credentials

Passwords are never stored. Cladior uses Supabase Auth, which handles password hashing with industry-standard algorithms. Cladior never has access to your raw password at any point, including at the moment of creation.

Session tokens are issued as short-lived JWTs and stored as httpOnly, Secure, SameSite=Lax cookies. They cannot be read by JavaScript running on the page.

Data isolation

Wallet balances, session records, and usage data live in an isolated database schema. Row-level security is enforced at the database layer, not in application code, so a misconfigured server function cannot inadvertently expose another user's data.

All financial calculations (charges, earnings, fee splits) execute server-side only. No billing logic runs in client-facing JavaScript.

Access control

Production database access is restricted to service-role API calls from Cladior server functions. No third-party tool, Developer integration, or external service has direct database access.

The Cladior admin surface (ctrl) is fully isolated, not exposed via any public API, and not accessible to end users or integrated Developers.

Sub-processor security

Cladior selects sub-processors that maintain their own security certifications appropriate to their role. Current sub-processors are listed in the Data Processing Agreement.

Responsible disclosure

If you discover a security vulnerability in any Cladior product or infrastructure, report it to security@cladior.com. Include a description of the vulnerability, steps to reproduce it, and the potential impact.

We will acknowledge your report within 48 hours and provide a resolution timeline within 7 days. Please do not publicly disclose the vulnerability until we have either patched it or reached a coordinated disclosure agreement with you.

We do not currently operate a formal bug bounty programme. We credit responsible disclosures publicly on a security acknowledgements page, with your permission.

Incident response

In the event of a confirmed data breach affecting user accounts, Cladior will notify affected users by email within 72 hours, consistent with NDPR obligations. The notification will describe what data was affected, what action was taken, and what steps, if any, users should take.