SOC 2 Type II
- Scope
- Security, on the Claren platform
- Period
- 1 May – 31 July 2026
Available through our trust centre, on request.
Security
Enterprise-grade security, verified and audited.
ISO 27001
- Scope
- Information security management system, ClarenAI UK Limited
- Certificate
- 26ISMS-1237, valid to 25 August 2029
01
Your data
- Each user has their own private, segregated data store, isolated from other users.
- Data is encrypted at rest (AES-256) and in transit (TLS 1.2+).
- All data, including read replicas, can be stored in a data centre in a specific region on request.
- Our terms of service and pilot agreements set out your right to delete your data at any time, and our privacy obligations.
- Data Processing Agreements are available on request.
02
Privileged material
- All data is treated with attorney-client privilege in mind.
- No cross-contamination between client matters or organisations.
- Audit trails are kept of user activity.
03
Training
- Neither Claren nor its model providers train AI models on your data.
- The only exception is updating your own company's Claren memories and playbooks.
04
Model providers
- Claren uses OpenAI, Anthropic and Google models through their APIs and, on request, the latest open-source models.
- OpenAI: API data is not used for training, and is not retained except to check for abuse (for at most 30 days) or where the law requires. Source ↗
- Google: data sent through the paid Gemini API is not used for training. Source ↗
- Anthropic: API data is not used for training. Source ↗
05
Infrastructure
- Hosted in US, UK or EU data centres, with data residency options for enterprise customers.
- Data is stored with Neon; authentication and user management run on Clerk.
- Claren uses SOC 2 compliant vendors and third-party software providers.
- Multi-factor authentication for administrative access.
- Regular penetration testing and vulnerability assessments.
- 24/7 security monitoring, with defined incident response procedures and SLA targets.
- Regular backups, with tested recovery procedures.
06
Access control
- Authentication through Clerk, which holds SOC 2 Type II and ISO 27001 certifications. Source ↗
- Account-specific login sessions, and API endpoints protected by authentication.
- Row-level security for organisation roles.
07
Our people
- Security awareness training at onboarding and on an ongoing basis.
- Access to production systems and customer data on a need-to-know basis only.
- Background checks for team members with access to sensitive systems.
Security questions
Anything else? Write to security@claren.law.
Is our data used to train AI models?
No. Neither Claren nor our model providers train AI models on your data, except to update your own company's Claren memories and playbooks.
Which model providers does Claren use?
OpenAI, Anthropic and Google models, through their APIs, and on request the latest open-source models. None of them use API data for training.
How do you handle privileged and confidential information?
All data is treated with attorney-client privilege in mind. There is no cross-contamination between client matters or organisations, and audit trails are kept of user activity.
Where is our data stored?
In US, UK or EU data centres, with data residency options for enterprise customers. All data, including read replicas, can be kept in a specific region on request.
Is Claren certified?
Yes. Claren has a SOC 2 Type II report covering Security, and its information security management system is certified to ISO 27001. Our trust centre is available on request.
Can we delete our data, or sign a DPA?
Yes. Our terms of service and pilot agreements set out your right to delete your data at any time. Data Processing Agreements are available on request.
