ClanTenant isolation
Each organisation, site or legal entity is separated from every other by design, not by a filter on shared data.
Trust Center
Security, privacy and AI governance, in one place.
Every application, every tenant and every AI action inherits the same controls from the platform. This page sets out what they are, and what we will put in writing for your review.
Compliance
Compliance
The same controls cover every application and every tenant — there is no second standard for the parts nobody looks at.
- SOC 2
- HIPAA
- Encryption in transit and at rest
- SSO and MFA
- Tenant isolation
- Business Associate Agreement
- Available to every healthcare customer.
- Exportable audit evidence
- Every view, change and AI action is logged and can be exported for an inspection.
- Security questionnaires
- We complete your questionnaire and provide the documentation behind each answer.
- Platform updates included
- Every customer runs the same, current version, so fixes reach everyone.
Data protection
How your data is protected
Controls that are part of the platform itself, not options to switch on.
Encryption throughout
Records are encrypted in transit and at rest, backups included.
Data residency
Where your regulator requires records to stay in a particular country, we deploy to meet it.
Role-based access
People see only what their job requires, per tenant and per module, with segregation of duties.
Single sign-on and MFA
Use the identity provider you already run, with your own password and session rules.
Complete audit trail
Every view, change and AI action is recorded — who, what, when, and the data an agent saw.
AI governance
AI governance
AI you cannot supervise is a liability. These controls are built in, and none of them are optional.
Four rules every agent follows
The same guardrails apply in every application and every tenant.
- You set the checkpoints
Choose which steps an agent may complete alone and which always need a named human to sign off.
- Everything is logged
Each AI action goes to the same audit trail as human actions, with the data it saw and the decision it made.
- Low confidence goes to a person
Results the AI is unsure of are flagged for review rather than acted on.
- It stays in your tenant
Your records are processed for you alone and are never used to train models shared with anyone else.
Your data is yours.
You can take it with you, and it is used for nothing except running your work.
- ExportYour records are exported on request, in full.
- TrainingNever used to train models shared with anyone else.
- AccessOnly the people your roles allow, and every view is logged.
- LocationKept in-country where your regulator requires it.
Documentation
Ask for our security documentation
Tell us what your review needs. We reply within one working day with the documents, or a time to walk through them with the people who run the platform.
Your details are used only to answer this request. We do not sell or share them.