Authentication
Passwords are hashed with BCrypt and are never stored or logged in plain text. Optional two-factor authentication (TOTP) can be enabled per account, backed by single-use recovery codes. Repeated failed sign-in attempts trigger a lockout, and refresh tokens rotate on use and are revoked immediately on logout.
Access control
Every API endpoint requires an authenticated user unless it is explicitly marked public — there is no accidental open endpoint. Sensitive endpoints such as sign-in and password reset are rate-limited per IP address, and security-relevant actions like logins, admin impersonation, permission changes, and tool calls from AI features and connected applications are written to a long-retained audit trail.
Connected apps (MCP)
MCP connections are off by default: an organization admin must enable them, and each member can only use the capabilities an admin has granted — viewing and editing are separate permissions. Connections use OAuth 2.1 with PKCE, audience-bound access tokens, and hashed, rotating refresh tokens. High-impact edits require the client to explicitly confirm an exact before-and-after preview, every tool call is recorded in the audit trail, and connections can be revoked at any time from Connected apps.
Data protection
Everything in transit is encrypted over TLS. Two-factor secrets, and password-reset and account-activation tokens, are encrypted before storage. Encryption of our database and file storage at rest is provided by our cloud infrastructure. Our database is backed up continuously, and we test the restore process end to end rather than assuming it works.
Data residency and hosting
AI processing — clash naming, the Wise chat assistant, and AI summaries — runs on Microsoft Azure OpenAI in Sweden, within the EU. The application itself is hosted on Hetzner infrastructure in Germany, within the EU. Customer data at rest, including our primary database, file storage, and transactional email, is held in the United Kingdom under the European Commission's adequacy decision.
Frequently asked questions
Does ClashWise support two-factor authentication?
Yes — optional TOTP-based two-factor authentication can be enabled per account, backed by single-use recovery codes, with the shared secret encrypted at rest.
Where is my data hosted?
Customer data at rest, including the primary database, file storage, and transactional email, is held in the United Kingdom. AI processing runs on Microsoft Azure OpenAI in Sweden, and the application itself is hosted on Hetzner infrastructure in Germany — all within the EU or under the UK adequacy decision.
Can an AI client connected via MCP change my data without asking?
No. MCP access is off until an organization admin enables it, members only get the capabilities an admin grants, and high-impact edits require the client to explicitly confirm an exact before-and-after preview before ClashWise applies the change. Every tool call is recorded, and connections can be revoked at any time.
How do I report a security issue?
Email support@clashwise.ai — reports are taken seriously and answered promptly.