How we look after your data

At a glance

Your data is stored in the Netherlands

Our database, API and backups run on Railway in Amsterdam. Our team works from the UAE.

We don’t train AI models on your data

Requests we send through OpenRouter go only to model providers that don’t collect what they receive.

Visitor IP addresses are discarded

We turn each IP address into a country and network, then drop it. We keep it only to check a request that claims to be a bot, and clear it after 90 days.

Your data is deleted 60 days after your plan ends

The owner gets two emails first. Deleting your workspace removes it straight away. Backups expire within 89 days.

We report breaches within 48 hours

We email your workspace owners within 48 hours of finding a breach that affects your data, and keep you updated.

Sign-in supports SSO and MFA

Single sign-on with SAML or OIDC, multi-factor sign-in, and roles with per-brand access.

Documents

How we protect your data

Encryption

Our website, app and API use TLS. CMS credentials, report links and webhook secrets are also encrypted inside the application with AES-GCM, on top of our host’s disk encryption.

Keeping customers apart

Every customer’s data is tied to its organisation in storage and in every query, so one workspace can’t read another’s.

Who on our side can reach it

Only named staff who need production access. Multi-factor sign-in is required on our code host and our identity provider.

Changes to the product

Every change ships through a pull request and must pass our automated tests before it reaches production, with no exception for admins. Dependency security alerts are on for every repository.

Collecting less

Email addresses, IP addresses and long tokens are removed from page addresses, referrers and titles before we store them. Our tracking snippet and pixel set no cookies.

Records of changes

Each workspace has an audit log of who changed what and when. Application logs hold no visitor IP addresses.

Monitoring

Failing health checks, bursts of errors and failed deploys email our team. A service outside our hosting checks every 30 minutes that Cleotic is up.

Backups

Daily, weekly and monthly backups, kept for up to 89 days, plus point-in-time recovery for about four weeks. Restores go to a separate copy, so live data is never overwritten.

Deletion

Deleting a workspace removes all its data in one step and cancels its subscription. Our providers delete their copies within 30 days, except where the sub-processor page says otherwise.