Public money runs through this system, so the controls around it are part of the product, not an afterthought. Here is how we protect your data and how we prove it.
Aclarian completes an annual SOC 2 Type II audit by an independent firm, covering security, availability, confidentiality, and processing integrity. The report is available to clients and active prospects under a mutual NDA. Requests go through our CTO.
Aclarian runs on Microsoft Azure in United States regions. Data is encrypted in transit and at rest. Each client’s data is logically separated, and access is scoped per client.
Role-based permissions by module, function, and data scope. Single sign-on through Microsoft Entra ID with multi-factor authentication at sign-in. Every login, change, and approval is logged, and a user access report supports the periodic reviews your auditor expects.
Vulnerability management and patching on a defined cadence, formal incident response, background-checked personnel with annual security training, documented change management, and tested backup and recovery.
Subprocessors are reviewed before onboarding and monitored on a schedule. We will share the current list on request.
We support client audits and IT security questionnaires. Send your requirements and we will map them to our controls.
