Security and Trust
Last updated: October 8. 2026
Related: Privacy Policy · Terms of Service
Contents
1. Overview
Clevera handles screen recordings, product footage and sometimes sign-ins to your own apps, so we treat security as part of the product. We design for:
least-privilege access
encrypted data flows
short-lived access to media
clear isolation of anything that touches the open web
2. At a glance
Encryption
TLS in transit; secrets, integration tokens and temporary credentials encrypted at rest
Hosting
Application servers managed with Laravel Forge on Hetzner; Postgres database not exposed to the internet
Storage
Amazon S3
Media delivery
Amazon CloudFront with signed, expiring links
Rendering
In your own browser by default; AWS Lambda for server renders
Sign-in
Two-factor authentication, new-device verification, Google sign-in, SAML 2.0 / OIDC single sign-on (Custom plans)
Access
Team roles inside the product; least-privilege staff access
AI
Commercial API terms with no training on your content
Payments
Lemon Squeezy (Merchant of Record); we never see card numbers
Compliance
Built to align with GDPR, UK GDPR, KVKK and CPRA; DPA on request
3. Infrastructure
Application and database. Our servers are managed with Laravel Forge on Hetzner EU(Germany). The Postgres database and Redis queue accept connections only from the application server, not from the internet.
Files. Recordings, uploads and generated media are stored in Amazon S3 in the US, with public brand assets in the EU (Sweden). Media is delivered through Amazon CloudFront.
Rendering. Videos render in your own browser by default, so the final encode happens on your device. Server renders run on AWS Lambda in the US.
Website visits. The components that visit websites for you run in two places:
Our own site scanner. It runs as a separate, restricted system user with no access to our API keys. An outbound firewall blocks it from reaching internal networks and cloud metadata endpoints, which protects against server-side request forgery.
Browser Use. AI-driven browsing runs in isolated cloud browsers at Browser Use, outside our infrastructure.
Data location. Data is processed mainly in the US and the EU. We do not currently offer customer-selectable data residency.
4. Data protection
In transit: all traffic to Clevera uses TLS.
At rest:
We encrypt the following at the application level:
integration OAuth tokens
SSO secrets
your own provider API keys
temporary website credentials
provider download links
Passwords are stored only as one-way hashes.
Stored files rely on the cloud provider’s encryption at rest (AWS SSE-S3).
Media access: private media is served only through signed links that expire, typically within 24 hours. Uploads go straight to storage through single-use pre-signed URLs.
Payments: handled entirely by Lemon Squeezy. Card data never reaches our systems.
Data minimization: we send each AI provider only what the job needs. For example, viewer analytics on shared videos keep only device class and country. Abuse prevention uses keyed hashes rather than raw IP addresses.
5. AI providers
Clevera uses AI models from Google (Gemini), Anthropic (Claude) and OpenAI. It also uses HeyGen for AI avatars.
We use these providers under commercial API terms that do not allow training on your content.
Some providers keep API data for a limited period, typically up to 30 days, for abuse monitoring.
Video files we upload for analysis are deleted from the provider within hours of the job.
We do not use your content to train AI models.
6. AI website research and credentials
“Record with AI” and website research run an AI agent in a cloud browser at Browser Use.
Credentials stay out of the model. Credentials you give for a run are passed to the browser as secrets. They are never placed in the AI model’s prompt and are redacted from logs.
Short-lived storage. On our side, credentials are held encrypted only while the job runs, then discarded.
Constrained research. Research runs are instructed not to sign in, submit forms or make purchases.
Saved sign-ins are optional. They are off by default and enabled per site. You can remove them at any time, and they expire after 30 days of non-use. They are deleted with your account.
Consent. Before the agent uses an account, the person setting up the run must confirm they are allowed to give Clevera access to it.
Use a test account. We recommend a dedicated demo or test account for filming.
7. Account security
Two-factor authentication: authenticator-app (TOTP) codes, with recovery codes.
New-device verification: when you sign in from a new device or location, we email a one-time code. Trusted devices are periodically re-verified.
Single sign-on:
SAML 2.0 and OpenID Connect on Custom plans
supports Okta, Microsoft Entra ID, Google Workspace, OneLogin and other standard identity providers
SSO secrets are encrypted
Google sign-in is available to all users.
Rate limiting protects sign-in, two-factor, verification and API endpoints against brute-force and abuse.
Team roles: Owner, Administrator, Editor and Content Creator. Each role controls what members can see and change.
API tokens for the desktop recorder are scoped to recording and can be revoked from your profile.
8. Application security
Code review and automated tests on every change.
Framework protections against common web risks, including CSRF tokens, output escaping, parameterized database queries and signed cookies.
Sanitization of uploaded SVG files.
Content-Security-Policy restrictions on which sites can be embedded in the app.
Signature verification on every incoming webhook (Lemon Squeezy, HeyGen, Amazon SES).
Secrets kept outside source control, with least-privilege service credentials.
9. Internal access
Production access is limited to authorized staff who need it.
Administrative tools in the app require a separate admin role.
Staff look at customer content only to provide support you request, to investigate abuse or incidents, or where the law requires it.
10. Logging and monitoring
Application and security logs are kept for about 14–30 days for troubleshooting and security review.
We alert on elevated error rates, failed jobs and unusual usage. A daily cost safeguard limits runaway usage on free accounts.
Usage and credit metering is built into Clevera; no third-party metering service is used.
11. Incident response
We follow a defined process to triage, contain and fix security incidents.
If a personal-data breach affects you, we will notify affected customers without undue delay, as the law requires. Under GDPR, we notify supervisory authorities within 72 hours where required.
12. Backups and continuity
The Postgres database is backed up daily by Laravel Forge. Each backup is a compressed dump stored in cloud object storage, encrypted at rest by the storage provider, and kept for 7 days. Older backups are deleted automatically.
Our services can be redeployed from source control.
Long-running jobs, such as rendering, research and generation, are queued and retried on failure.
13. Data retention and deletion
Your content: kept while your account is active.
Trash: items in trash are permanently deleted after 7 days.
Unused recordings: recordings not used in any video are deleted after 15 days.
Account deletion starts immediately. It:
cancels subscriptions
revokes tokens and saved sign-ins
permanently deletes owned teams’ recordings, videos and files shortly afterwards
Backups expire on their retention schedule.
Full details are in our Privacy Policy.
14. Compliance
GDPR, UK GDPR and KVKK. We are the controller for account, billing and website data. For your content, we act as a processor under our Data Processing Addendum. International transfers use Standard Contractual Clauses, the UK Addendum or KVKK standard contracts as required.
CPRA. We do not sell or share personal information, and we do not engage in cross-context behavioral advertising.
SOC 2 / ISO 27001. We plan to obtain SOC 2 and ISO 27001 certification in 2027.
DPA: available on request at team@clevera.ai.
15. Sub-processors
Amazon Web Services
Storage (S3), content delivery (CloudFront), server rendering (Lambda), email (SES)
Hetzner
Application servers and database
Google (Gemini API, Cloud Text-to-Speech)
AI analysis, writing, translation, narration and images
Anthropic
AI models that write and direct videos, and the in-app assistant
OpenAI
Transcription, captions and AI models, including website research
Browser Use
Cloud browsers for AI website research and “Record with AI”
HeyGen
AI avatars, presenter voices, music and sound-effect search
Brandfetch
Public brand logos by domain
Lemon Squeezy
Payments, invoicing and tax (Merchant of Record)
Slack
Internal team notifications, including support messages
ipgeolocation.io
Sign-in location for account security
Tiptap
Article editor AI and document export
Laravel Nightwatch
Application monitoring
The full list, with data categories and locations, is in our Privacy Policy. We notify customers of material changes as our DPA describes.
16. Vulnerability disclosure
If you think you’ve found a security issue, email team@clevera.ai with details and steps to reproduce.
Please:
test only against your own account
avoid accessing or changing other people’s data
avoid degrading the service
avoid automated high-volume scanning
give us reasonable time to fix the issue before disclosing it publicly
We will acknowledge your report, keep you updated and credit you if you’d like. We will not pursue legal action against good-faith research that follows these guidelines.
17. Contact
Security and trust: team@clevera.ai
Odise Studio (Clevera), Yenişehir Mah. Kardeşler Cad. 7/2, Sivas, Türkiye