01How we work with you
claused. handles the regulatory obligations of real construction and infrastructure projects. We take security seriously and welcome reports from researchers and users. We aim to acknowledge reports within two business days and to provide an initial assessment within seven. Critical issues are triaged faster.
02Reporting a vulnerability
Email support@claused.com.au with:
- A description of the issue and its potential impact.
- Steps to reproduce. Proof-of-concept code is appreciated but not required.
- The URL, parameter or feature affected.
- Your name or handle if you would like to be credited in our public acknowledgements.
03In scope
claused.com.auand all subdomains- The claused. web application and authenticated user flows
- The portal at
/portal/* - The public API, once shipped
- The field app and its capture endpoints
04Out of scope
- Denial-of-service and volumetric attacks
- Social engineering of claused. staff, contractors or customers
- Physical attacks against our infrastructure or offices
- Issues only reproducible on outdated browsers, jailbroken or rooted devices, or unpatched operating systems
- Reports purely about email spoofing (SPF, DKIM, DMARC) without a demonstrable impact path
- Automated scanner output without manual validation and a working proof of concept
05Safe harbour
If you make a good-faith effort to comply with this policy during your research, we will not pursue legal action against you and will work with you to understand and resolve the issue quickly. Good faith means:
- You do not access, modify or destroy data that is not yours.
- You stop testing and report immediately once you have confirmed an issue.
- You do not publicly disclose before we have had time to fix.
- You do not extort or threaten us with disclosure.
06Bounties
claused. does not currently offer monetary bounties. We are happy to credit researchers publicly with their permission, and to provide references where useful.
07How claused. is built
- Next.js hosted on Vercel: TLS, DDoS protection and a WAF at the edge.
- Supabase Postgres in
ap-southeast-2(Sydney): AES-256 encryption at rest, row-level security on every table holding customer data. - Document parsing and condition extraction run with providers under data-processing agreements. The full list is in the sub-processor table below.
- Authentication through Supabase Auth. Bcrypt for any password or PIN hashing outside Supabase Auth, including subcontractor portal PINs. Two-factor authentication with an authenticator app can be turned on by any user under Account, Security. Once on, a session that has not entered the code cannot open a signed-in page.
- Automated dependency scanning and secret scanning on every push.
- Synthetic health checks run hourly against production and notify on regression.
- Uploaded source documents are hashed with SHA-256 on receipt and the hash is stored with the record, so the retained copy can be shown to be the one that was extracted from.
Machine-readable disclosure metadata at /.well-known/security.txt.
08Data residency and processing
Customer data at rest lives in one place: a Supabase project in Sydney (ap-southeast-2). That covers the Postgres database (accounts, projects, conditions, inspections, corrective actions, incidents, permits, activity logs) and Supabase Storage (the approval-docs bucket holding retained source documents and the project-documents bucket holding evidence and supporting files). Both buckets are private. Files are served through short-lived signed URLs, never public links.
Application code runs on Vercel. Requests pass through Vercel's edge network for TLS termination and filtering before reaching the application. Some processing steps send data to third parties for a specific job and nothing else:
- When you upload an approval document, its text is sent to Anthropic for condition extraction. For some documents the file is first sent to Reducto for layout parsing.
- When claused. emails you or your team, the address and message content pass through Resend.
- When you pay, Stripe handles the card and the subscription. claused. never receives card numbers.
- Rainfall triggers for ESC inspections read public observations from the Bureau of Meteorology or WillyWeather. Only a gauge or location identifier is sent. No customer data leaves for this.
Some of these providers operate outside Australia. Where a region is not fixed by our configuration it is governed by that provider's data-processing agreement, and the table below says so rather than guessing.
09Sub-processors
The third parties that handle customer data on behalf of claused., what each one does, and what it sees. We will update this table before adding a sub-processor that handles customer data.
| Provider | Purpose | Data handled | Region | DPA |
|---|---|---|---|---|
| Vercel | Application hosting, edge network, TLS, DDoS protection and WAF. Aggregate page analytics and performance measurement. | All application traffic in transit. Server logs. Cookieless page-view counts. | Global edge network. Function region: see provider DPA. | In place |
| Supabase | Postgres database, authentication and file storage for uploaded approval documents and evidence files. | All customer data at rest: accounts, projects, conditions, records, evidence files, activity logs. | ap-southeast-2 (Sydney) | In place |
| Anthropic | Condition extraction. Claude models read approval document text and propose register entries. | Text of uploaded approval documents. Project name and document type. | See provider DPA. | In place |
| Reducto | PDF layout parsing for documents where plain text extraction is not enough. Used when enabled in the deployment, not for every document. | Uploaded approval document files sent for parsing. | See provider DPA. | In place |
| Resend | Transactional email: invitations, notifications, deadline reminders, support replies. | Recipient name and email address. Notification content, which can include project and condition names. | See provider DPA. | In place |
| Stripe | Subscription billing. Card details are entered on Stripe's hosted checkout and never reach claused. servers. | Billing name, email, company, payment method, subscription status. | See provider DPA. | In place |
| Serper | Optional public web search when a project is created, to pre-fill public project context. | Project name, state and document type only. No document content, no personal data. | See provider DPA. | Provider terms |
Source code is hosted on GitHub with dependency and secret scanning. GitHub does not hold customer data.
10How AI is used
Condition extraction is performed by a large language model. When you upload an approval, licence, consent or management plan, claused. sends the document text to Anthropic's Claude models, which read it and propose register entries: the condition, its type, its timing and the party responsible. A second pass checks the proposed set for gaps and duplicates.
Extraction proposes. It does not decide. Every extracted condition is held as unreviewed until a qualified person on your project reviews it. The register review gate lists the high-risk conditions, the low-confidence extractions and the conditions with no responsibility assigned, and the register is not treated as verified until a person has been through that list and marked it so. The review is written to the project activity log.
Every extraction can be checked against its source. The verbatim clause is kept beside each condition, and the uploaded document is retained with its SHA-256 hash, so an auditor can open the instrument and confirm the wording the register is built on.
claused. does not use customer documents to train models. Documents are processed by our providers under data-processing agreements for the purpose of extraction and nothing else.
11Automated decision-making
This disclosure is written to meet the transparency requirements introduced by the Privacy and Other Legislation Amendment Act 2024 for computer programs that make, or substantially assist, decisions using personal information.
- claused. uses automated extraction to propose entries in a compliance register from documents you upload.
- A person reviews the proposed entries before they count. Extracted conditions are unreviewed until a qualified person confirms them.
- Rainfall-triggered inspections are raised automatically when a gauge reading meets the trigger set on the inspection template. That schedules work for a person to do. It does not judge whether anyone complied.
- No decision that has a legal or similarly significant effect on an individual is made automatically by claused. The system records what people did and when. It does not determine compliance, rate individuals, or take action against anyone without a person deciding.
12Certifications and roadmap
Plainly, so nobody has to ask twice.
- SOC 2: not held.
- ISO 27001: not held. On the roadmap, with no date set.
- IRAP: not assessed.
- Single sign-on (SAML or OIDC with your identity provider): not built. On the Programme roadmap.
- Multi-factor authentication: available. Time-based one-time codes from an authenticator app, turned on per user under Account, Security, and enforced by the application on every signed-in page. Enforcement for a whole team is not yet a setting.
What is in place today is on this page: encryption in transit and at rest, row-level security, Australian data residency for data at rest, tamper-evident source documents, scanning on every push, hourly synthetic monitoring and a working disclosure process. Our infrastructure providers hold their own certifications, which we can point you to on request.
13Security questionnaires
If your procurement process needs a security questionnaire completed, send it to Jake, the founder, at support@claused.com.au. Expect a completed response within five business days, and faster for a short one. Where a question asks for something this page says we do not hold, the answer will say so.