Clarity AI

Clarity AI hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Security isn't a single yes/no, but Clarity AI is SOC 2 Type II compliant and holds ISO 27001, SOC 2 Type II, CSA STAR. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Clarity AI hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@clarity.ai or via a /security page (Clarity AI lists a security contact).

Clarity AI lists 6 subprocessors on its trust center, including Amazon Web Services, Microsoft Azure, OpenAI, Snowflake, MongoDB Atlas. Buyers use this for fourth-party risk review.

Clarity AI hosts on AWS, Azure, and handles Employee personally identifiable information, Customer user business credentials for access to Clarity AI Services. Data residency details are on its trust center.

Clarity AI's trust center is at https://trust.clarity.ai. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

We are committed to building responsible and sustainable AI, aligned with our core mission of bringing societal impact to markets. Our approach to minimizing the environmental footprint of AI includes: - Use of resource-efficient models: We favor smaller, specialized models wherever possible to minimize energy usage without compromising accuracy. - Green cloud infrastructure: Our systems are hosted on cloud providers committed to net-zero goals, with compute operations run in carbon-efficient regions. - Lifecycle assessments and impact tracking: We track compute consumption associated with AI model training and inference and aim to incorporate AI lifecycle metrics into our broader ESG reporting practices.

We follow a Responsible AI framework grounded in transparency, fairness, and regulatory readiness: - Auditability and documentation: Every model we deploy undergoes rigorous documentation through model cards and accuracy and risk assessments. - Bias and fairness testing: We regularly assess our models for disparate impact across demographic and geographic segments, particularly in sustainability and regulatory contexts. - Explainability: Outputs include interpretable rationale, as we provide human-readable justifications, traceability to source data, and explainable methodology and scores. - Governance and oversight: Clarity AI maintains an internal and cross-functional AI and Data Governance Committee to review model performance and alignment with our Responsible AI charter.

Yes, our platform offers full traceability and auditability of AI-generated outputs: - Data lineage: Clients can trace results back to the underlying data points and classification logic, supporting full auditability. - Private and segregated data handling: Client-specific data (e.g., investment portfolios) is processed in logically segregated environments and is never co-mingled or reused across clients. - Responsible data use: No client data used for model training (see details in the next question).

No, we do not use client data to train any of our AI models. We are fully committed to safeguarding our clients’ data privacy. Our AI systems, including generative models, are trained exclusively on data sources that exclude customer data. We also ensure that our technology partners and vendors follow the same principles — client data is never used for model training or fine-tuning under any circumstances.

We implement rigorous measures to ensure the confidentiality, integrity, and security of all client data, including: - Robust security measures: All systems are configured following industry best practices, including strong user authentication, secure APIs, and strict access controls to protect AI systems and associated data. - Zero data retention policy: Our AI systems do not retain any sensitive client data beyond what is necessary for real-time or immediate processing. This principle is core to our commitment to data minimization. - Third-party risk management: We conduct comprehensive third-party risk assessments to ensure all vendors and service providers meet our high security and privacy standards, including those who support AI systems or infrastructure. - Data protection and privacy compliance: All personal and sensitive data is handled in accordance with applicable data protection regulations (e.g., GDPR, CCPA). Data is encrypted both in transit and at rest using robust cryptographic standards. - Responsible data use: We do not use client data to train or fine-tune any AI models. As part of our quality assurance efforts, we may review anonymized or client-authorized interactions with our AI Assistant in a controlled and secure environment. This enables performance monitoring and continuous improvement without compromising privacy.

Clarity AI takes appropriate measures to comply with applicable data protection legislation. Relevant policies and procedures are in place to address topics such as data protection, privacy, impact analysis, data subject requests, and processing activities. For more information please see our Privacy Policy Please note Clarity AI acts as the data controller for the services it provides. Our solution is not aimed at the processing of personal data and we therefore minimize its collection & processing. The data made available in our products consists mainly in scores and metrics, which are not personal data.

Clarity AI collects and processes only the minimum data necessary to deliver its services securely and effectively. These data categories include: - User authentication data: We require a unique email address for each authorized user to provide secure access to the Clarity AI platform. Clients may choose to use generic, non-personal email aliases (e.g., analysis@example.com) or personal business emails. If a personal email is used, it may be considered personal data under applicable data protection laws (e.g., GDPR). - Platform usage data: We collect limited metadata related to platform usage (e.g., login timestamps, feature access) to improve platform reliability and security, and to support audit and compliance needs. - Client-provided business data: Clients may upload business-relevant data such as portfolio holdings, ESG metrics, or classification preferences. This data is used solely to provide the services requested and is processed in secure, logically segregated environments. - No special category or sensitive data: Clarity AI does not collect or require sensitive personal data (e.g., biometric, health) for any purpose. All data processing activities are conducted in compliance with applicable privacy laws and our Privacy Policy.

Clarity AI VULNERABILITY DISCLOSURE POLICY This vulnerability disclosure policy applies to any vulnerabilities you are considering reporting to us. We recommend reading this vulnerability disclosure policy fully before you report a vulnerability and always acting in compliance with it. We value those who take the time and effort to report security vulnerabilities according to this policy. However, we do not offer monetary rewards for vulnerability disclosures. REPORTING If you believe you have found a security vulnerability, please submit your report to [security@clarity.ai](mailto:security@clarity.ai) . In your report, please include details of: - The website, IP or page where the vulnerability can be observed. - A brief description of the type of vulnerability, for example; "XSS vulnerability". - Steps to reproduce. These should be benign, non-destructive, and proof of concept. This helps to ensure that the report can be triaged quickly and accurately. It also reduces the likelihood of duplicate reports, or malicious exploitation of some vulnerabilities, such as sub-domain takeovers. WHAT TO EXPECT After you have submitted your report, it will be triaged and we aim to respond all valid/accepted reports promptly, usually within 5 working days. Priority for remediation is assessed by looking at the impact, severity and exploit complexity. Vulnerability reports might take some time to triage or address. You are welcome to enquire about the status by contacting [security@clarity.ai](mailto:security@clarity.ai) , but should only do so once every 14 days. This allows our teams to focus on the remediation. If your report is accepted, we will notify you when the vulnerability is remediated, and you may be invited to confirm that the solution covers the vulnerability adequately. Once your vulnerability has been resolved, we welcome requests to disclose your report. We'd like to unify guidance to affected users, so please do continue to coordinate public release with us…