Trust centre.
Where client documents are processed, who can see them, how AI models use them, and what has and hasn’t been independently assessed yet.
Last updated 19 October 2026
Documents
| Document | Access |
|---|---|
| Security overview | Public |
| Architecture diagram | Public |
| AI and your data | Public |
| Subprocessor list | Public |
| Privacy notice | Public |
| Data processing agreement | On request |
| Completed security questionnaire | On request |
| Backup and restore-drill records | On request, under NDA |
| Penetration test summary | Under NDA, once the test is complete |
Independent assessment
Clava has not yet been independently certified. This is where each assessment stands.
| Assessment | Status | Scope |
|---|---|---|
| CREST penetration test | Being booked | The Clava cloud application and its AWS London infrastructure |
| Cyber Essentials Plus | In progress | Clava’s company IT and the Clava cloud service |
| SOC 2 Type II | Planned | The Clava cloud service |
| ISO 27001 | Planned | Clava’s information security management system |
| AWS and Microsoft Azure | Current, renewed by each provider | The data centres and cloud services Clava runs on. Their ISO 27001 and SOC 2 reports are available from AWS Artifact and the Microsoft Service Trust Portal. |
Each report’s date and scope will be listed here when it is issued.
Our commitments
- No training on your dataYour prompts, documents and outputs are never used to train, fine-tune or evaluate any AI model, by us or by any provider.
- UK and EU processing onlyClient data is stored and backed up in AWS London. AI models run in Microsoft Azure and AWS, in London and EU regions.
- Incident notice within 48 hoursOf confirming an incident that affects your firm’s data, we tell your firm’s owner, with updates until it is closed.
- Fix timesCritical vulnerabilities within 7 days, high within 30 days and medium within 90 days.
- 30 days’ notice of changeBefore a new subprocessor, a new hosting or processing location, or a new AI model provider. You may object, and terminate without penalty if we can’t resolve it.
- Deletion you can proveWhen you leave, we destroy your firm’s own encryption key and send your owner a signed certificate of destruction.
Questions from your security team?
Send us your questionnaire. We’ll answer it and share anything marked on request.