Security
How OClever protects your data
Where your data lives, how it is protected and what happens if something goes wrong. These are the measures in our Data Processing Addendum, written out in plain language.
Security measures
What we do.
- Hosting
- Production systems and customer data are hosted on Amazon Web Services in the Mumbai (India) region, relying on AWS's physical and environmental security controls.
- Encryption
- Data is encrypted in transit using TLS 1.2 or higher. Data at rest in databases and storage is encrypted using AWS-managed encryption.
- Passwords and tokens
- User passwords are stored only as salted one-way hashes. Access tokens for AI assistant (MCP) connections are stored as one-way hashes. OAuth tokens for connected accounts are stored server-side, encrypted, and are never exposed to the browser.
- Access control
- Access to production systems is limited to authorised personnel on a least-privilege basis, protected by multi-factor authentication, and revoked promptly when no longer needed.
- Customer separation
- Customer data is logically separated by account, and application-level access controls prevent one account from accessing another's data.
- Logging and monitoring
- Administrative access and security-relevant events are logged and monitored. Logs are retained as required by applicable law, including CERT-In directions.
- Backups
- Customer data is backed up regularly, backups are encrypted, and restoration is tested periodically.
- Secure development
- Code changes are reviewed before deployment, dependencies are monitored for known vulnerabilities, and secrets are kept out of source code.
- Vulnerability management
- Security patches for production systems are applied in a timely manner according to severity.
- Incident response
- OClever maintains an incident response process covering detection, containment, investigation, notification (including to customers within 48 hours of becoming aware of a personal data breach, and to CERT-In) and post-incident review.
- People
- Personnel with access to customer data are bound by confidentiality obligations and receive guidance on data protection and security.
- Vendors
- Sub-processors are assessed for security and data protection before engagement and are bound by written terms.
- Data minimisation
- The service imports aggregated data from Google Search Console and Google Analytics 4 rather than user-level data, and prompts sent to third-party AI platforms are designed not to contain personal data.
Compliance and contracts
Where to read more.
- Privacy Policy
What personal data we collect, why, how long we keep it and your rights under India's Digital Personal Data Protection Act, 2023 and the UK and EU GDPR.
- Data Processing Addendum
Our commitments as a processor, including the full technical and organisational security measures, breach notification within 48 hours and audit rights.
- Sub-processors
The providers that process customer data for us, what they process and where, with 30 days' notice before a new one is added.
- Security questions and reports
Customers can ask for written answers to a security questionnaire once a year under the Data Processing Addendum. To report a vulnerability or ask a question, contact us.