Every claim, with its evidence.

Real-time service status

Live uptime monitoring for the app, the client portal, the API and authentication, with public incident history.

status.kliper.dev

Security architecture

How we protect evidence: a SHA-256 hash of every upload, malware scanning with ClamAV and a VirusTotal hash lookup, strict tenant isolation, and guardrails on Cortex.

Security overview · docs.kliper.dev/security-and-ai-trust

AI in PCI assessments

Cortex, our AI assistant, is built to the PCI SSC “Integrating AI in PCI Assessments” guidance. It is a tool for the assessor, never a replacement for their judgment.

• The assessor decides. Cortex proposes findings and drafts; every change it makes asks for confirmation first, and the QSA makes the compliance determination.
• No fabrication. It answers from the assessment’s own data and cited PCI guidance. When there is no data, it says so.
• Traceable. Answers cite real PCI DSS requirement numbers and quote saved values verbatim.
• Sensitive data protected. Card numbers, IP addresses and other personal data are redacted before any AI call.
• No training. Cortex runs on OpenAI and Anthropic models through their APIs, whose terms exclude API data from model training. A self-hosted model profile is available where prompts must stay on your own infrastructure.

Subprocessors

The authoritative list of every third party that processes customer data: what each one receives, the region it processes in, and a link to its DPA. Customers under a DPA get 30 days’ notice before a new subprocessor is added.

docs.kliper.dev/subprocessors

Vulnerability disclosure

We follow RFC 9116. Found something? Email security@kliper.dev. We acknowledge within 2 business days and do not pursue legal action against good-faith researchers.

/.well-known/security.txt

Data protection & recovery

All customer data is encrypted in transit (TLS 1.2+) and at rest. The production database ships its write-ahead log continuously to off-site object storage for point-in-time recovery, alongside nightly full dumps kept for 30 days.

• RPO target: 5 minutes or less. In practice the write-ahead log ships at least every 60 seconds.
• RTO target: 4 hours or less.
• Restore verification: weekly, by an automated drill that restores the backup and checks it. A drill that fails to run raises an alert.

Customers on a paid plan can request our disaster-recovery one-pager and the latest restore log from security@kliper.dev.

Audit access for assessors

Firm administrators can export the complete audit trail (every field-level change, with actor, timestamp, IP address and user agent) for any date range, as CSV or JSON. It answers SOC 2 and QSA peer-review evidence requests. Audit export is part of the Firm plan.

Admin dashboard guide: audit export

Privacy & Terms

Privacy Policy: what we collect, how we use it, and your rights.

Terms of Service: the contractual basis for using the platform.

Changelog: every material change to subprocessors, security and this page is logged there.