Security

Last reviewed October 2026.

Clavarius holds the names and movements of your staff and visitors, so you deserve a straight answer on how that is protected. This page describes what we do today, in the same words as our Privacy Notice and Data Processing Agreement. It is practice, not a certificate, and where we do not do something, we say so.

At a glance

• Hosted in the United Kingdom, with encrypted backups kept in Western Europe.
• Every connection is encrypted (HTTPS), and browsers are told never to use anything else.
• Each organisation's data is kept apart from every other's at the database level, not only in the application.
• Nightly backups are encrypted before they leave the server. The key to decrypt them is held separately, and restores are tested.
• Registered with the UK Information Commissioner's Office, registration number ZB787276.
• You stay in control: export everything, choose how long records are kept, erase a person, or close your account yourself.

Where your data lives

The application and its database run on servers in the United Kingdom. Backups are encrypted before they leave those servers and stored with Cloudflare in Western Europe. Email is sent through a specialist provider in the EU. Payments are handled by Stripe, so card details never touch Clavarius. The full list of providers, and the legal basis for any transfer outside the UK, is in the Privacy Notice.

Keeping organisations apart

Clavarius serves many organisations from one service. Each organisation's data sits in its own separate area of the database, and the database itself refuses access across those boundaries. A mistake in the application cannot show one customer's people to another, because the database would not allow it. Every request is checked against the signed-in account's organisation; nothing about which organisation you belong to is trusted from the browser.

Logins and accounts

• Passwords are stored only as strong one-way hashes. We cannot read them, and neither could anyone who obtained a copy.
• After several wrong passwords, sign-in for that account is slowed down and then paused for a few minutes.
• Changing or resetting a password ends every other session for that account, on every device.
• Password reset links are sent by email, expire after an hour and work once.
• Sign-in tablets use a separate access account that cannot reach your settings, people or reports. If a tablet is lost, change that account's password and it is signed out everywhere.
• View-only links for the live Signed-in List can be switched off at any time from your admin area.

The servers

• A firewall allows only web traffic in. The database is not reachable from the internet at all.
• Administrative access is by key only, never by password, and repeated failed attempts are blocked automatically.
• Security updates are applied regularly.
• The service is monitored continuously and we are alerted when something is wrong.

Backups and recovery

Backups are taken every night, encrypted on the server before they are copied anywhere, and kept both on the server and off-site. The key needed to read them is held outside the server. We test that a backup can actually be restored. Because backups are kept for a limited period, data you delete also leaves the backups within about five weeks.

Your controls inside Clavarius

• Export everything as spreadsheets in one ZIP, whenever you like.
• Retention you choose. Keep sign-in records for 3 months to 3 years, or for ever; older records are deleted overnight.
• Erase a person without breaking your history.
• Visitor phone numbers are deleted overnight once the visitor has left.
• Roles. Owners and admins manage settings; staff and viewers cannot. Tablets never can.
• Close your account yourself, with 30 days to change your mind before everything is deleted.

Email

Every email Clavarius sends on your behalf, from roll-call lists to visitor notifications, is logged in your admin area, so you can see what went to whom and whether it was delivered.

Cookies and tracking

The Clavarius app uses only essential cookies: the ones that keep you signed in and protect forms. There is no advertising or tracking inside the app. Our website uses analytics cookies only if you accept them. Details are in the Cookie Notice.

What we do not claim

We are not currently certified to ISO 27001 or Cyber Essentials. This page describes practice, not a certificate. If your organisation needs a signed Data Processing Agreement or has a supplier questionnaire, email us and we will complete it.

Reporting a security concern

If you believe you have found a vulnerability, email hello@clavarius.io. We will acknowledge it within one working day and keep you informed while we fix it. Please do not test against live customer data; a free trial account is the right place to look.