Security Whitepaper
Claform Security Overview
Surveys people finish
A comprehensive look at how we protect your data across infrastructure, application, authentication, and operational layers.
Executive Summary
Security by Design
Claform is an enterprise survey and feedback platform that processes millions of responses across 190+ countries through 8 distribution channels. Security is not an afterthought; it is a foundational design principle embedded in every layer of our architecture.
Our security philosophy is built on defense in depth: multiple overlapping controls that ensure no single point of failure can compromise data integrity or confidentiality. We combine industry-standard encryption, strict access controls, continuous monitoring, and regular third-party audits to maintain the trust of organizations handling sensitive feedback data.
This document provides a technical overview of our security controls across six domains: infrastructure, application, data protection, authentication, compliance, and operational security.
Infrastructure Security
Our platform runs on enterprise-grade cloud infrastructure designed for high availability, fault tolerance, and defense in depth.
Cloud Hosting
Hosted on AWS with multi-AZ deployments across geographically distributed regions. Auto-scaling groups maintain performance under peak load.
Network Isolation
Virtual Private Cloud (VPC) with private subnets, NAT gateways, and strict security groups. No direct internet access to application servers.
DDoS Protection
AWS Shield Advanced with CloudFront CDN provides multi-layer DDoS mitigation. Rate limiting and WAF rules block malicious traffic before it reaches application logic.
Backup & Recovery
Automated daily database snapshots with 30-day retention. Point-in-time recovery within the last 5 minutes. Cross-region backup replication for disaster recovery.
Application Security
Security is embedded throughout our development lifecycle, from code review to production monitoring.
Input Validation
All user input is validated, sanitized, and parameterized at multiple layers. Strict type checking with TypeScript prevents entire categories of runtime vulnerabilities.
OWASP Top 10 Coverage
Systematic protections against all OWASP Top 10 risks including injection, broken authentication, XSS, CSRF, insecure deserialization, and security misconfiguration.
Dependency Scanning
Automated scanning of all dependencies on every build. Snyk and GitHub Dependabot monitor for known vulnerabilities. Critical CVEs are patched within 24 hours.
Penetration Testing
Annual third-party penetration tests by certified security firms. Continuous automated vulnerability scanning. Bug bounty program for responsible disclosure.
Data Protection
All data is encrypted at rest and in transit using industry-standard cryptographic algorithms and strict key management.
AES-256-GCM at Rest
All stored data including survey responses, uploaded files, and personally identifiable information is encrypted with AES-256-GCM. Database-level transparent data encryption adds a second layer.
TLS 1.3 in Transit
All network communication uses TLS 1.3 with strong cipher suites. HSTS headers enforce HTTPS. Certificate pinning in mobile SDKs prevents man-in-the-middle attacks.
Key Management
Encryption keys are managed through AWS KMS with automatic annual rotation. Keys are never stored alongside data. Hardware Security Modules (HSMs) protect master keys.
PII Detection
Automated PII detection in open-text survey responses identifies names, emails, phone numbers, and addresses. Flagged data can be automatically redacted or require review.
Authentication & Access Control
Enterprise-grade identity management with multiple authentication factors, granular permissions, and comprehensive session control.
SAML 2.0 SSO
Native support for Okta, Azure AD, OneLogin, Google Workspace, and any SAML 2.0 identity provider. Just-in-time provisioning and automatic role mapping.
TOTP Multi-Factor Authentication
Time-based one-time password MFA with authenticator app support. Can be enforced organization-wide or per role. Recovery codes with secure storage.
API Key Scoping
Fine-grained API keys with per-endpoint permissions, rate limits, IP restrictions, and automatic expiration. Full audit trail of key usage.
Session Management & IP Allowlisting
Configurable session timeouts, concurrent session limits, forced logout, and geographic IP allowlisting. Real-time session monitoring and anomaly detection.
Compliance & Certifications
We build to align with global data protection regulations to meet the requirements of regulated industries.
GDPR with Data Processing Agreement
Full GDPR compliance including data subject rights (access, rectification, erasure, portability), consent management, and a comprehensive Data Processing Agreement (DPA).
TCPA & CASL
Built-in compliance for SMS and voice campaigns with TCPA consent tracking, opt-out management, and Canadian Anti-Spam Legislation (CASL) compliance.
SOC 2 (Type II controls)
Built around the SOC 2 Type II trust principles: security, availability, and confidentiality. Enterprise customers can request our current security documentation under NDA.
HIPAA BAA Available
Business Associate Agreement available for healthcare organizations. HIPAA-compliant data handling, access controls, and audit logging for protected health information.
Operational Security
Security extends beyond technology to our people, processes, and organizational practices.
Employee Background Checks
All employees undergo comprehensive background checks prior to hire. Access to production systems requires additional security clearance.
Security Training
Mandatory annual security awareness training for all employees. Engineers complete additional secure coding courses and phishing simulations.
Incident Response
Documented incident response plan with defined roles, escalation procedures, and communication templates. Regular tabletop exercises and post-incident reviews.
Vulnerability Disclosure
Responsible disclosure program with clear reporting channels. Security researchers can report vulnerabilities to [email protected] with safe harbor protection.
Download the Full Whitepaper
Get the complete security whitepaper as a PDF for offline review, compliance audits, or to share with your security team.
Download Security Whitepaper (PDF)Need a Deeper Review?
Schedule a security review with our team. We are happy to walk through our architecture, share SOC 2 reports, and answer your security questionnaires.