How ClearScreen handles tenant data

Console sign-in uses your Spot Suite account through Spot Suite OIDC at spot-cloud.spot-suite.com, with Microsoft Entra ID single sign-on on the Business plan. Device agents never see user passwords.

Trials and shared data live in the shared EU Supabase Postgres project (Paris); a paid workspace has its own Supabase project in the region chosen at purchase.

Policy, block events, and enrollment records are scoped to your tenant. Rows do not cross customer boundaries.

Trials run in the EU; a paid workspace runs in the region chosen at purchase, and its database is stored there. Whatever the region, shared bundle files (R2) and the hourly backup dump sit in Cloudflare object storage in Western Europe, not pinned to an EU jurisdiction. Operated by Spot Cloud B.V.

Block events record device, domain, category, source, and timestamp. The Console exports the latest 25 events as CSV or JSON.

Managed agents authenticate with per-device csk_ API keys, sha256-hashed server-side. Keys are stored at 0600 permissions on the endpoint.

Threat feeds ship as ed25519-signed gzip bundles. Agents verify the signature before applying indicators — offline cache keeps the last verified bundle.

Enforcement is DNS-only. Blocked domains sinkhole to a local block page. No TLS inspection, PAC file, or network gateway in the policy path. On Linux, a blocked HTTPS site may show a browser certificate warning instead of the block page.

Platform controls are mapped to GDPR, DORA, and NIS2. Audit evidence and the control-mapping pack are shared under NDA.