Clickalong / Trust
Security at Clickalong
Last updated 13 August 2026This page states the controls Clickalong operates today and the assurance work that remains. It is deliberately narrower than a certification badge.
Current assurance status
Clickalong is not currently SOC 2 certified, has not completed an ISO 27001 audit, and does not offer HIPAA workloads or a BAA. We do not describe a vendor’s certification as our own. Customers can use the controls and documents on this page for an initial security review; audited assurance remains future work.
Architecture and data protection
- Encryption. Traffic is served over HTTPS. Cloudflare D1 databases and R2 objects are encrypted at rest with provider-managed keys. Platform master secrets live in Cloudflare’s secret store and never enter client bundles. Customer-directed integration credentials use authenticated encrypted credential envelopes in D1, bound to their exact workspace and provider; the independent encryption key stays in the secret store.
- Workspace isolation. Operator routes derive authority from the signed-in member and exact workspace URL. Widget routes use short-lived visitor authority bound to one workspace and visitor. Database reads and writes carry the workspace boundary, and sensitive lifecycle transitions re-check authority immediately before mutation.
- Least privilege. Workspace roles separate owners, admins, and agents. New developer tokens are workspace-bound, expiring, revocable, and explicitly scoped; token plaintext is shown once and only its hash is retained. Existing coding-agent tokens remain narrowly tour-scoped during compatibility migration; these legacy compatibility tokens remain revocable but do not gain an expiry retroactively.
- AI privacy. Only the bounded conversation and relevant knowledge needed for an answer are sent to the configured model chain. OpenAI requests use
store:false. Cloudflare AI Gateway payload logging and caching are disabled. Recorder screenshots, HTML snapshots, selectors, and action callbacks are not model context for ordinary chat. - Network boundaries. Public-page imports validate every HTTPS redirect and reject private or reserved destinations. Provider retries are owned by the application and bounded. Outbound writes are explicit, idempotent where the provider permits it, and never silently replay a customer action.
- Recovery. D1 Time Travel provides point-in-time database recovery. Durable outboxes use leases, deterministic deduplication, and bounded retries. Deployment applies additive migrations before activating the new Worker and verifies production health.
Product controls
Customers control workspace membership, exact embed origins, public help content, lead collection, AI instructions, guided tours, and task-execution opt-in. Workspace deletion is a retained tombstone for diagnosis rather than an immediate destructive purge; contact us for a rights or deletion request that requires permanent removal.
Responsible disclosure
Send a concise report, affected URL, reproduction steps, and impact to security@profitoniumapps.com. Do not access another customer’s data, disrupt production, perform social engineering, or publish a live issue before we have had a reasonable opportunity to investigate. We will acknowledge a credible report, coordinate remediation, and keep the reporter informed.