Security

Last updated: 1 September 2026

Clarius handles sensitive corporate compliance data including emissions figures, financial information, and director declarations. Security is not an afterthought — it is a core design requirement for a platform that feeds into director declarations under the Corporations Act 2001.

Infrastructure

Clarius is hosted entirely on Microsoft Azure infrastructure in the Australia East region (Sydney). We use:

• Azure Static Web Apps — frontend delivery via global CDN with automatic HTTPS
• Azure Functions (v4) — serverless backend API with per-request authentication
• Azure PostgreSQL Flexible Server — with pgvector extension for semantic search, encrypted at rest using Azure-managed keys
• Azure Application Insights — backend telemetry and error monitoring

Data Encryption

• In transit: all data transferred between your browser and Clarius servers is encrypted using TLS 1.2 or higher. HTTPS is enforced on all endpoints.
• At rest: all data stored in Azure PostgreSQL is encrypted at rest using AES-256 via Azure-managed encryption keys.

Authentication and Access Control

• All platform access requires authentication via a session token issued at login
• Tokens are validated on every API request; no request is processed without a valid, active session
• Role-based access control restricts what each user can see and do within their organisation's workspace
• Admin functions require elevated role verification
• Sessions expire automatically after a period of inactivity

Audit Trail

Every action within the Clarius workflow is logged with a timestamp, actor identity, and role. This audit trail is a core compliance feature — it is designed to satisfy ASSA 5010 limited assurance evidence requirements and to support director declarations under s296A(6) of the Corporations Act 2001. The audit trail cannot be altered or deleted by users.

Human Review as a Security Control

Clarius's nine-gate approval workflow requires human sign-off at each material stage. No AI-generated output can be submitted to ASIC or used in a director declaration without passing through one or more human approval gates. This is not just a product feature — it is a security and accuracy control that limits the impact of any AI error or data quality issue.

Third-Party AI Services

Clarius uses Anthropic (Claude API) and Voyage AI for AI processing and semantic search. These services process your data under contractual terms that prohibit use of your data for model training. See our Data Use Policy for details.

Vulnerability Reporting

If you discover a potential security vulnerability in the Clarius platform, please report it responsibly to hello@clariusonline.com. We will acknowledge your report within 48 hours and work to address confirmed vulnerabilities promptly.

Contact

For security enquiries, contact hello@clariusonline.com.