Security
How Clawzia protects your data
Withdrawal statements are evidence. We keep them safe, store as little personal data as possible and make every receipt verifiable without revealing who sent it.
Where the data is hosted
Our servers and the database are located in: United States (Buffalo, New York).
What we do to protect the data
Encrypted connections
Every page, form and API call uses HTTPS, and browsers are told to use HTTPS only (HSTS).
Encrypted backups
Database backups are encrypted before they are stored. The key is kept apart from the application.
Access control
Passwordless sign-in links expire after 15 minutes and are stored only as hashes. Each account sees only its own shops and requests.
Audit log
Status changes, exports and settings changes are recorded in an audit log, so every action can be traced.
Pseudonymised IP addresses
For abuse protection we store IP addresses only as keyed hashes, never in plain text.
No cookies in the widget
The withdrawal button sets no cookies and loads nothing from third parties. The dashboard uses a single session cookie.
Receipt fingerprints
Every confirmed withdrawal gets a SHA-256 fingerprint. Anyone can verify a receipt without seeing personal data.
A careful checker
The free checker refuses private network addresses, re-checks every redirect and limits time and size of each request.
Minimal data
Addresses for checker reports and stored API responses are encrypted (AES-256-GCM) and deleted when they are no longer needed.
Contracts and sub-processors
The data processing agreement page shows the terms of our processing on behalf of shops and their current status. The list of sub-processors names every provider that processes data for us, and our privacy policy explains what we store and for how long.
Trust centre: facts and documents
These values are read from the running system, so they cannot drift from what the product does. The legal documents below are the binding texts.
- Sign-in links expire after 15 minutes and can be used once.
- Every receipt carries a fingerprint (sha256-v1) that anyone can check on the verification page, without seeing the statement or any personal data.
- The withdrawal widget sets no cookies and loads no third-party trackers.
Documents
Report a security issue
If you believe you found a vulnerability in Clawzia, please tell us privately first. We will confirm your report, keep you informed and fix confirmed issues as fast as we can.
- Do not access, change or delete data that is not yours; use test accounts where possible.
- Do not run automated scans that slow down the service for others.
- Give us reasonable time to fix the issue before you publish anything about it.