Security
Security built into everyday business workflows
Clientlly combines access boundaries, organisation separation, account safeguards and traceable activity to protect connected business records.
Our approach
Six principles that protect your records
Role-based access
Set visibility and actions according to each person's responsibilities, branch and module scope.
Organisation separation
Tenant-aware boundaries keep each organisation's operational records within its authorised workspace.
Account safeguards
Controlled sign-in and account protections help prevent unauthorised access to sensitive business records.
Activity and audit history
Supported workflows retain activity context so important actions and record changes can be reviewed.
Data handling and privacy
Security and privacy requirements are reflected in access, processing and data-handling practices.
Responsible disclosure
Report suspected vulnerabilities through the Clientlly contact channel for responsible investigation.
Security details
What protects your data, specifically
- Encrypted connections
- The website and the app are served only over HTTPS.
- Hashed passwords
- Passwords are stored only as bcrypt hashes, never in readable form.
- Two-step sign-in
- Use an authenticator app or a passkey. Admins can require it for everyone in the organisation.
- Roles and permissions
- Decide who can see and change what, down to individual modules.
- Audit log
- Each change records who made it, on which record, when and from which IP address. Admins can view and export it.
- Separate data per organisation
- Every request is limited to your own organisation’s records.
- Encrypted secrets
- Tokens for connected accounts and payment keys are encrypted with AES-256-GCM. API keys are stored only as hashes.
- Devices and sessions
- See where you are signed in and sign out any device.
- Password-guessing protection
- Repeated failed sign-ins are blocked automatically.
- No card data stored
- Card payments are processed by Paddle, Stripe or PayPal. Card numbers never reach Clientlly.
- Export and deletion
- Admins can export all organisation data. Users can delete their account, with a 30-day grace period.
- Leaked-key scanning
- Every code change is scanned automatically for leaked keys and passwords.
In the product
Authentication and security
Sign-in
- Email/password authentication
- Social login
- Email verification
- Password reset and change
Sessions
- Active-session list
- Individual session revocation
- Logout from all devices
- Session replacement when limits are reached
Tenancy and audit
- Multi-organization access
- Tenant isolation
- Granular roles, modules, and action permissions
- Audit logging
Password vault
- Personal encrypted password vault
- Argon2id/PBKDF2 vault key derivation and migration
- Vault recovery envelope
- Browser-extension pairing for the password vault
Found a security issue?
Send suspected vulnerabilities or security concerns directly to Clientlly for responsible review. Please include steps to reproduce and never access other customers’ data.
Contact Clientlly securityBring your business workflows together
Start a 14-day free trial — no card, no lock-in. Import your customers and invoices and see the full picture on day one.