Security
How we keep your data safe.
Infrastructure
ClearingHouse is hosted on Hetzner in Nuremberg, Germany, managed via Laravel Forge. Hetzner data centres are ISO 27001 certified and comply with strict European data protection standards.
All connections to ClearingHouse are encrypted in transit with TLS (HTTPS).
Authentication
Passwords are hashed with bcrypt and never stored in plain text. We support two-factor authentication (2FA) and recommend all users enable it.
Data Encryption
Sensitive data — including OAuth credentials and two-factor secrets — is encrypted at rest before being stored in our database. Encryption keys are managed separately from the database itself.
Third-Party Connections
When you connect your Stripe and FreeAgent accounts, we use OAuth to authenticate. We only request the permissions necessary to perform the service. We do not store your Stripe or FreeAgent passwords.
Stripe manages its connection credentials server-side. FreeAgent OAuth tokens are encrypted at rest and automatically refreshed as needed.
Payment Security
Subscription billing is handled entirely by Stripe. We do not store your payment card details.
Access Controls
Access to production servers, source code, and third-party services is limited to the founder. SSH access to production is restricted to our VPN.
All accounts use strong, unique passwords generated by a password manager. Two-factor authentication is enabled on all services where it is available.
Devices are protected with biometric authentication (Touch ID / Face ID) and full-disk encryption via FileVault on Mac.
Development Practices
All code changes go through automated testing before deployment. Errors are tracked in production using Laravel Nightwatch. Dependencies are kept up to date and monitored for known vulnerabilities.
Data Retention
We retain data only as long as necessary. Activity logs are automatically deleted after 90 days. Webhook data is deleted after 7 days. Sessions expire after 120 minutes of inactivity. Full details are in our Privacy Policy.
Incident Response
In the event of a data breach, we will notify affected users without undue delay, and in any event within 72 hours, as required by UK GDPR. We will also notify the Information Commissioner's Office where required.
Reporting a Vulnerability
If you discover a security vulnerability, please email us at [email protected]. We take all reports seriously and will respond promptly.