The controls in place today, and the ones we have not built yet.

Every part of the workspace that carries substance is in Google Cloud's Johannesburg region: grants, deadlines, budgets and financial figures, uploaded documents, funder and donor records, evidence notes and the audit trail. The database and the file storage are both in region, and every Cloud Function is pinned to it in code, so a new function cannot quietly be created elsewhere. Scheduled jobs that send reminders, build digests, run accounting sync and purge deleted workspaces are invoked privately by Cloud Scheduler and cannot be triggered from the public internet.

Three ancillary functions: sign-in on Firebase Authentication, which holds your email address and account identifier and nothing else; reminder and digest email through Resend in the United States, carrying titles, dates and links only; and the optional accounting sync, which reads tagged ledger lines from Xero, QuickBooks Online or Sage. Each is disclosed under section 72 of POPIA in sections 5 and 6 of the privacy notice.

Data sits on Google Cloud's managed database and storage services, which replicate within the Johannesburg region and cycle backups on a rolling schedule at the platform layer. Deleting a workspace is reversible for 30 days before the purge job erases it. An administrator can export the full workspace as JSON at any time from Settings, then Your data.

not yet in placeNo published point-in-time recovery window and no tested restore procedure with a stated recovery time objective. Until we have run and documented a restore drill we will not claim one. If your funder or auditor needs a recovery commitment in writing, write to us and we will tell you exactly where we are.

Every sensitive change is written by server-side triggers, not by the browser, so the record exists whether or not the person meant to leave one. The trail is append-only: entries are never edited or deleted through the product, and the security rules expose no update or delete path on it. Resolutions and board decisions work the same way. We say append-only rather than tamper-proof, deliberately: anyone with sufficient privileges at the cloud provider level, ourselves included, operates below the application. That is true of every hosted product.

Access is scoped per organisation and per role. Separation between workspaces is enforced in the database and storage security rules, keyed on the signed-in user's authentication claims, and every server-side operation re-checks the caller's role rather than trusting the browser. Financial records are restricted to administrators and the finance role. Field evidence capture is restricted to administrators, editors and field officers. Paying money out needs two people: prepared by one, approved by another, enforced on the server. The 7 roles: Administrator, Editor, Finance, Field Officer, Reviewer, Board Member, Viewer.

Email and password through Firebase Authentication over TLS, with Google's protections against credential stuffing and password reset abuse behind it. Sessions are token-based and an administrator can remove a person's access immediately, effective on their next request. Data is encrypted in transit and at rest. Accounting credentials are encrypted a second time at the application layer, with a key held in Secret Manager away from the database.

not yet in placeTwo-factor authentication is not available yet, and there is no way for an administrator to require it across a workspace. It is the control we are asked about most. Until it ships, use a password manager and a unique password, and assign the finance role sparingly.

Write to security@claripick.com with what you found, how to reproduce it, and how to reach you. We will confirm receipt, work the issue, and tell you what we did. We will not take legal action against someone who reports a genuine issue in good faith and gives us a reasonable chance to fix it before publishing. If a breach compromises personal information we will notify the Information Regulator and the affected users, as section 22 of POPIA requires. We do not run a paid bug bounty; we have no budget for one yet and would rather say so.