Security overview

Clad is built for insurance brokerages that handle confidential client information. This section describes the controls that apply to your Clad environment.

At a glance

Area	Control
Isolation	Each customer runs in its own dedicated Clad environment: its own AWS account, database, compute, AI inference, workflow namespace and document text extraction. None of these is shared between customers.
Hosting	Amazon Web Services, United States.
Encryption in transit	TLS 1.2 or higher on every connection.
Encryption at rest	AES-256 for databases, backups and stored files.
Integration access	Scoped to what you grant. For Microsoft 365, a mail group you manage and individual SharePoint sites (see the permissions reference); for phone systems, the users you choose.
Credentials	Microsoft 365 access uses a federated identity credential, with no client secret or certificate. Credentials you issue, such as a phone system API key, are stored encrypted and revocable from your own console.
Employee sign-in	Single sign-on through your identity provider, under your MFA and access policies.
Resilience	Recovery time objective of 4 hours; recovery point objective of about 5 minutes.

Compliance

Attestation	Trust Services Criteria	Status
SOC 2 Type 1	Security, Confidentiality	As of 25 September 2026
SOC 2 Type 2	Security, Confidentiality	In progress

Reports are available under NDA. Email security@cladinsurance.com to request them.

Testing and assurance

External vulnerability scanning: a commercial scanner (Tenable Nessus Expert) scans the platform from outside, both signed out and signed in, monthly and after any material change.
Cloud workload scanning: workloads and container images are scanned continuously inside the AWS accounts.
Penetration testing: an independent third party tests the platform.
Tenant isolation: the separation between customer environments is tested at the AWS level.