Trust & Security

Accounts are protected with email/password and supported OAuth providers. Administrative access to the back office is restricted to a named team and is gated by both a verified identity claim and an entry in our internal admin directory.

Application data is segmented per workspace using row-level security policies in the database, so workspace data is only readable by members of that workspace.

The app runs on managed cloud infrastructure with encryption in transit (HTTPS) for all traffic between users and our services. Data at rest is stored by our managed database and object-storage providers using their platform-level encryption.

We collect the account, workspace, client, invoice, HR, and document data you choose to enter, plus standard operational metadata such as timestamps and audit logs of administrative actions. We do not sell personal data.

We use a small set of vetted subprocessors to run the service, including our hosting/database provider, email delivery, and payments. The list is available on request from the contact below.

Workspace data is retained while your account is active. On account closure, data is removed from active systems within a reasonable window; backups expire on their normal rotation. You can request export or deletion using the contact address below.

If you believe you have found a vulnerability, please email security@clientohub.app with steps to reproduce. We acknowledge reports within a few business days and ask that you avoid testing against other customers' data.

For privacy questions, data export, or deletion requests, contact privacy@clientohub.app.