Security — how we protect your code and data

Real primitives that align with SOC 2 and GDPR. Formal certifications are on the way — what is already built is described here honestly.

Isolation architecture

Every project on the Hosting tier runs in its own dedicated pod: a separate container, a separate DB schema, an encrypted secret vault. No shared runtime between projects, no cross-tenant access, no shared attack surface.

Free tier projects run on StaticBackend (Cloudflare R2 + Workers). They have no runtime at all — there is no server to break into, just static files. Pod-per-project is a Hosting tier feature; the Free tier gets a different kind of isolation, but isolation nonetheless.

The control plane (services.project_pods) is the only path that talks to RunPod. No other code in the system creates or destroys pods — which guarantees the schema-isolation and secret-vault logic is never accidentally bypassed.

Encryption

All public traffic flows through a Cloudflare Tunnel over TLS 1.3. There is no endpoint that accepts plain HTTP. SSL certificates auto-renew.

Secrets (user API keys, BYO Anthropic keys, Supabase service-role keys) are encrypted with Fernet (AES-128-CBC + HMAC-SHA256) using CLAWEX_KEK held outside the DB. Without the KEK, the row in the DB is worthless.

The bridge to claude.ai uses HMAC-SHA256 on every message to protect pipe integrity. Primary key rotation is scheduled every 90 days.

Auditing & monitoring

Every sensitive operation — admin, secrets, data export and deletion, pod creation and termination — is recorded in an immutable audit log. The table is append-only at the database level: on Postgres we REVOKE UPDATE/DELETE; in the application layer there is no method that rewrites rows.

Retention: 90 days hot in the primary DB, 7 years cold in R2 (gzipped jsonl, one object per month). Full history is available for incident investigation years after the event.

Watchdogs auto-recover from common failure modes. faulthandler captures native crashes. Sentry ships exceptions to the operations dashboard. Telegram pages the on-call. Anything that isn't caught automatically is recorded in the audit log.

Privacy & data rights

ClawEX is designed from the ground up with primitives that align with GDPR and CCPA: data export, deletion on request, opt-out from analytics and AI training. All actions are available from the user interface — one click, no form, no waiting.

Data regions: us-east, us-west, eu-central, eu-west, ap-south. EU regions are automatically flagged GDPR-relevant. The choice of region affects where the project pod lives and where its backups are stored.

Retention policy at a glance: content (builds, projects) — lifetime of the account; audit log — 7 years; backups — 30 days hot + 1 year cold; operational logs — 90 days.

🟢 8200.dev integration — Live

Polling interval: 8200.dev fetches our manifest every 15 minutes — real-time governance.

Detection confidence: 99% — 8200.dev treats ClawEX's definitive <meta name=ai-builder content=ClawEX> signature as a confidence-99 signal on every build.

Governance flag: every build is marked governed: true in the manifest.

Recognized alongside: Lovable, Base44, Bolt.new, Cursor.

A two-way protection layer

ClawEX is protected by 8200.dev — our OAuth apps, our AI agents, and every build we generate are monitored in real time.

✅ meta tag ai-builder=ClawEX (EU AI Act transparency requirement)

✅ Security manifest (structured JSON with permissions, scopes, AI model)

✅ Automatic detection in 8200.dev if your organization uses it

✅ Full audit trail for SOC2 / ISO 27001

Enterprise governance

Every app built with ClawEX ships a security manifest your IT team can audit — who built it, what permissions it requests, and when it was deployed. ClawEX builds are compatible with 8200.dev's AI Application Governance.

The manifest is available at /api/builds/<build-id>/security-manifest and can be imported into 8200.dev or any security tool. This turns 'AI-built app risk' into a governed, auditable application. Learn more on our enterprise page.

Subprocessors

Third parties that may process customer data. All are governed by a DPA and SCCs where required by EU footprint.

DPAs and Standard Contractual Clauses are in place with every subprocessor that handles EU data. The list is maintained in docs/INTEGRATIONS.md (source of truth) and auto-synchronised to this table at build time.

Responsible reconstruction

ClawEX can rebuild a site or app from a link or a screenshot — but it is reconstruction, not replication. The output is an original, editable project inspired by the reference, never a pixel-for-pixel or byte-for-byte copy, and never a tool for intercepting another service’s traffic.

Guardrails are built in from day one: requests to clone login, payment, or banking screens are blocked, brand impersonation and phishing are refused, and every reconstruction is bound by the Acceptable Use Policy (ToS §5A). You confirm you have the right to rebuild what you submit.

Incident response

Severity ladder P0–P3 is documented in the internal runbook. P0 = production outage or suspected data exposure — immediate response. P1 = major feature down with no data risk — within an hour. P2 = degraded UX — same business day. P3 = cosmetic — next sprint.

Notification commitment: within 72 hours of discovering a breach affecting customer data, we email every affected customer. Tabletop drills run every quarter to verify the chain works. Security incident reports: [email protected].

Compliance roadmap

GDPR primitives — implemented. Export, deletion, opt-out, data residency, audit log, retention policies — everything the regulation requires of the underlying infrastructure.

Formal DPA + DPO — in progress with privacy counsel. SOC 2 Type II — planned for the second half of 2026, after launch and with 6 months of documented operational history. ISO 27001 — evaluated once the enterprise customer base justifies it.

We do not claim compliance before it is real. What is already built is described as fact. What is not — is described as a goal.

Contact

Security questions and problem reports: [email protected]. DPA / privacy requests: [email protected]. Response within 2 business days. Breach reports or suspected exposure are top priority.