Security & Trust Center

ClearSignalQ Inc. takes the security and confidentiality of customer information seriously. This page summarizes our security practices, how data is handled, and the providers we rely on. For questions or a security review, contact info@clearsignalq.io.

Data Encryption

• In transit: all traffic is encrypted using TLS (HTTPS).
• At rest: data is stored in managed cloud infrastructure that encrypts data at rest by default.

Access Controls

• Authentication is required for all application and data access.
• Administrative access is limited on a need-to-know basis.
• Secrets and credentials are stored in managed environment configuration, not in source code.

Data Ownership

Customers retain ownership of the data they submit. We process customer data solely to provide and improve the Services, and we do not sell personal information or use customer data to train public AI models. See our Privacy Policy.

No Protected Health Information (PHI)

ClearSignalQ is built on publicly available business information and must not be used to store or transmit PHI. We do not act as a HIPAA Business Associate and do not offer BAAs. This keeps the platform outside HIPAA scope by design.

Sub-Processors

We rely on the following key sub-processors, each under contractual confidentiality and security obligations. We update this list as our providers change.

Provider	Purpose
Railway	Application hosting
Supabase	Database (PostgreSQL)
Stripe	Payment processing (when paid plans are offered)
Anthropic	AI processing
PostHog	Product analytics

Hosting & Infrastructure

The Services run on reputable managed cloud platforms (Railway, backed by major cloud providers) with database services provided by Supabase. These providers maintain their own security and availability programs.

Availability

We design the Services for reliable availability but do not guarantee uninterrupted access. Maintenance and incidents may cause downtime.

Incident Response

If we become aware of a security incident affecting customer data, we will investigate, take reasonable steps to contain and remediate it, and notify affected customers as required by applicable law.

Compliance Status

ClearSignalQ is an early-stage product. We follow the security practices described above. We are not currently certified under formal frameworks such as SOC 2 or ISO 27001, and we do not currently offer HIPAA Business Associate Agreements. We will update this page as our compliance posture matures. For enterprise security questionnaires or a Data Processing Addendum, see our DPA or contact us.

Contact

Security questions or to report a vulnerability: info@clearsignalq.io.