Your most sensitive information
deserves more than a checkbox.
A compliance platform holds allegations, conflicts, investigations and personal data. ClariAze is designed so that every record is protected, attributable and provable — and so that anonymity is a property of the system, not a promise.
Four commitments behind every design decision.
Least access
People see what their role needs — and nothing from another company.
Everything attributable
Every meaningful action is recorded with who, what and when.
Privacy by design
Collect only what is needed; store nothing that would identify an anonymous reporter.
Humans decide
AI is advisory; decisions belong to accountable people.
How ClariAze protects your data.
Tenant isolation
Each company's records, documents and attachments are separated. Every file download re-checks the reader's right to the record the file belongs to; unknown files are refused.
Role-based access
Employees see their own records; compliance officers their company; administrators the platform. Pages outside a role are refused and the attempt is logged.
Immutable audit trail
Sign-ins and failed sign-ins, changes, approvals, rejections, downloads and exports — recorded with outcome and time. Nobody, including administrators, can edit or delete an entry.
Encrypted in transit
All traffic is served over HTTPS with strict transport security, content-type protection, a referrer policy and a permissions policy.
Credentials & sessions
Passwords are stored as salted hashes and must meet a strong-password rule. Sessions expire, and forms are protected against cross-site request forgery.
Safe file handling
Uploads are limited to document and image types with size limits; only PDFs, images and text open in the browser — everything else is downloaded, so no uploaded file can run as a page.
Anonymity you can explain to a regulator.
When a reporter chooses anonymity, ClariAze is built so that the system itself cannot identify them.
- No name, email or phone is stored with the report
- No network address or browser details are stored
- The audit trail records “Anonymous reporter” — even when the person is signed in
- Reporting pages send no referrer to other systems
- The tracking key is shown once and stored only as a one-way hash
- Only the company's compliance team and administrators can read reports
Constrained AI, by default.
ClariAze AI is a feature with a narrow job. These constraints are part of the product, not settings someone can forget to turn on.
Inside ClariAze AIScope-locked
Only risk, compliance and governance work; everything else is declined.
Injection defences
Hidden instructions in text or documents are screened before and after the model runs.
Purpose-limited
Inputs are sent to the AI service only to produce the analysis; results are stored in your company's records.
Advisory only
Every proposal is accepted or declined by a person, with the reason recorded.
Security & privacy FAQ.
Can another company see our data?
No. Records, documents and attachments belong to one company. Access checks are enforced on the server for pages and for every file download, not only in the interface.
Can administrators change the audit trail?
No. Audit entries cannot be edited or deleted by anyone, including platform administrators.
How is an anonymous reporter protected if they use a company computer?
ClariAze stores no identity, contact details or network address for anonymous reports and does not attribute the submission in its audit trail, even for a signed-in user. Reporters should still avoid including details in the description that point to themselves.
How is personal data in the platform handled?
ClariAze is designed around GDPR-style principles, and our Privacy Notice explains what is collected, why, and your rights. The platform also gives your own privacy team registers for breaches, subject requests and DPIAs.
How do we report a security issue?
Write to [email protected] with the subject “Security report”. Please include the steps to reproduce and give us reasonable time to respond before any disclosure.
Bring your security questions.
We'll take your security and privacy team through the controls in detail.