1. Purpose and Scope
This Security Baseline describes the administrative, technical, and physical safeguards Clasp maintains to protect Customer Data from unauthorized access, consistent with Section 5 (Data & Security) of the Agreement. This Appendix does not create or imply compliance with any specific regulatory framework or certification unless expressly stated.
2. Security Governance
Clasp maintains internal security policies governing:
- access control
- credential management
- secrets management
- incident response
- change management
- vendor and subprocessor review
- acceptable use of internal systems
Clasp personnel with access to Customer Data are required to follow these policies and receive periodic security awareness training.
3. Access Control & Authentication
3.1 Role-Based Access Controls
The Service supports Firm User, Admin, and Super Admin roles. Access to administrative functions is restricted to authorized personnel.
3.2 Authentication Model
Users sign in using either a one-time password (OTP) delivered by email or “Sign in with Google.” OTP constitutes multi-factor authentication for purposes of this Agreement. OTP codes are delivered through an email-based authentication flow. Clasp does not currently support SAML, enterprise single sign-on, or other identity-provider integrations.
3.3 Customer Responsibilities
Customer is responsible for securing the email and Google accounts used to sign in, including enabling the security features those providers offer, and for managing user provisioning and deprovisioning.
4. Data Storage & Encryption
4.1 Encryption at Rest
Customer Data stored within the Service is encrypted at rest using industry-standard encryption provided by Clasp’s cloud infrastructure.
4.2 Encryption in Transit
Customer Data transmitted between Customer and the Service is encrypted using HTTPS/TLS.
4.3 Customer-Managed Keys
Clasp does not currently provide customer-managed encryption keys. If introduced in the future, such features may limit or disable certain functionality, and Clasp will not be able to recover Customer Data if Customer mismanages its keys.
5. Secrets Management
Integration tokens, credentials, and system secrets are stored in an enterprise-grade secrets management system. Access to secrets is restricted to authorized personnel and logged within Clasp’s internal systems.
6. Data Processing Architecture
6.1 OCR & Text Extraction
Clasp uses Unstructured.io to perform OCR and extract text for indexing and search. OCR is read-only and does not modify document content.
6.2 Embeddings
Text embeddings generated for search and retrieval are stored in Clasp’s database. Embeddings may persist until configurable deletion logic is implemented.
6.3 External AI Processing
Customer Data is not transmitted to external large language models for training or inference, and AI-Assisted Functionality operates on metadata or embeddings only, with one exception: when Customer elects to enable both the optional Time Capture module and AI processing for Time Capture, Clasp sends system-generated metadata (not document text) to OpenAI to generate draft time-entry descriptions, as described in Appendix H.
7. Hosting & Infrastructure Security
7.1 Cloud Providers
Documents and files are stored in Google Cloud Storage in per-organization buckets. Structured application data, account data, and embeddings are stored in a managed database hosted by Supabase. Clasp selects hosting regions and configurations; region selection is not configurable by Customer.
7.2 Backups, Prior Versions & Durability
Clasp relies on the native durability and redundancy of its infrastructure providers and does not maintain separate customer-accessible backups. Clasp may retain prior versions of documents and records for its own operational purposes. Prior versions are not accessible to Customer through the Service unless Clasp expressly makes them available, and Clasp does not guarantee that any prior version exists, how long it is retained, or that Customer Data can be recovered or restored.
7.3 No DR/BCP Commitments
Clasp does not guarantee:
- multi-region replication
- disaster recovery RTO/RPO targets
- secondary backup sites
- cold-storage tiers
unless expressly stated in an Order Form.
8. Logging & Monitoring
8.1 Activity Logs
Clasp maintains lightweight activity logs showing significant actions within cases and tasks.
8.2 System Logs
Backend system logs may contain metadata necessary for debugging and operational monitoring.
8.3 Error Monitoring and Bug Reporting
Clasp uses error monitoring and in-application bug reporting tools, as listed in Appendix H, to detect and fix errors and improve the user experience. These tools may collect technical information such as device, browser, and error details, and any information a User chooses to include in a bug report.
8.4 No Audit Log Module
Clasp does not currently provide a customer-facing audit log or reporting module. Logs are not included in standard data exports.
8.5 Retention
Log retention periods may vary and are not guaranteed. Logs may persist in system backups until backup cycles expire.
9. Incident Response
9.1 Acknowledgment
Clasp will acknowledge a security incident affecting Customer Data within forty-eight (48) hours of Clasp’s confirmation of the incident. Security reports from Customers will be reviewed on a commercially reasonable efforts basis.
9.2 Investigation & Remediation
Clasp will use commercially reasonable efforts to investigate and remediate confirmed incidents.
9.3 Notification
Clasp will notify affected Customers without unreasonable delay following confirmation of an incident involving Customer Data.
10. Subprocessors
Clasp may use subprocessors to provide the Service, including cloud hosting, database, OCR, email delivery, messaging, payments, document editing, error monitoring, and AI-assisted features. The current list of subprocessors is provided in Appendix H and may be updated from time to time.
11. Customer Security Responsibilities
Customer is responsible for:
- securing its own systems, devices, and networks
- managing user access
- safeguarding credentials
- ensuring Customer Data submitted to the Service complies with applicable laws and professional obligations
- promptly notifying Clasp of any actual or suspected unauthorized access
12. Limitations
This Security Baseline does not constitute:
- SOC 2 compliance
- ISO 27001 compliance
- GDPR/CCPA compliance
- HIPAA compliance
- PCI-DSS compliance
- any representation of meeting specific regulatory frameworks
Clasp uses these frameworks as guides, is working toward alignment with them, and uses a compliance management framework to implement and track its security controls and policies, as described in Section 5.7 of the Master Services Agreement. That effort is not a commitment or representation that Clasp will achieve or maintain any certification, attestation, or compliance.
Clasp may update its security practices and this Appendix at any time, as described in Section 17.9 of the Master Services Agreement.