Security

Clampdown is an early-stage product built by a small team, and this page says what's actually in place rather than what sounds reassuring. We hold no security certifications yet — no SOC 2, no ISO 27001. If you need one to buy, tell us and we'll be straight with you about timing.

Reporting a vulnerability

If you believe you've found a security issue, email security@clampdown.ai. Machine-readable contact details are published at /.well-known/security.txt. We'll acknowledge your report and keep you posted on the fix. Please give us a reasonable window to respond before any public disclosure, and don't run tests that degrade the service or touch other people's data.

Infrastructure

Everything runs on Cloudflare: the site and API are Workers on Cloudflare's edge network, customer data lives in Cloudflare D1, and transactional email goes out through Cloudflare Email Sending. We operate no servers of our own and hold no copies of the database outside that platform. Cloudflare's own compliance posture is published on their Trust Hub.

Data protection

• Traffic is served over HTTPS, and D1 storage is encrypted at rest by Cloudflare.
• Passwords are stored only as salted hashes, handled by our authentication library — we never see or store the plaintext.
• Sessions are cookie-based, marked secure in production, expire on their own, and record the IP and user-agent they were created from so an unexpected sign-in is visible.
• Data is scoped to your organisation, and team members hold roles that determine what they can do.
• Secrets — API tokens, the auth secret, database credentials — are held as Cloudflare secrets, never committed to the repository. Access to production data is limited to the people who operate the service.

Abuse controls

The public piracy audit is protected by Cloudflare Turnstile, verified server-side, and it fails closed in production — a submission that can't be verified is rejected rather than let through.

Sign-in and password-reset attempts are rate-limited per IP address, as are submissions to the audit tool, so credential-stuffing and scripted abuse hit a wall well before they get anywhere.

Secure development

Every change runs through CI before it can ship: lint, type-check, a full web build, and a Worker bundle check. Dependency updates come in through Dependabot. Changes land on main, deploy to a staging environment with its own isolated database, and only then reach production — staging never touches production data.

Monitoring

Errors and performance are reported to Sentry. Session replay is configured to mask all text and form inputs and to block media, so we can see how a page broke without collecting what was on it.

Subprocessors

The providers that may process customer data are listed, with what each one receives, in the Privacy Policy: Cloudflare, Apify, Sentry, and Cal.com.

Contact

Security questions during a vendor review? Email security@clampdown.ai.