US
Start free trial

Security

How ClearScreen handles tenant data

Each customer gets a dedicated Customer Environment on Cloudflare Workers and D1. Device agents enforce policy locally; the cloud edge holds policy, block events, and enrollment records — all tenant-scoped under Spot Cloud B.V.

  • Spot Suite OIDC sign-in

    Console sign-in uses Microsoft Entra ID through Spot Suite OIDC at spot-cloud.spot-suite.com. Device agents never see user passwords.

  • Dedicated per-customer isolation

    Each Customer Environment runs on its own Cloudflare Worker, D1 database, and storage. No shared infrastructure between tenants.

  • Tenant-scoped data

    Policy, block events, and enrollment records are scoped to your tenant. Rows do not cross customer boundaries.

  • US data residency

    Customer Environments run in the US region, operated by Spot Cloud B.V.

  • Audit logging and export

    Block events record device, domain, category, source, and timestamp. Export as CSV or JSON from the Console.

  • Hashed device credentials

    Managed agents authenticate with per-device csk_ API keys, sha256-hashed server-side. Keys are stored at 0600 permissions on the endpoint.

  • Signed indicator bundles

    Threat feeds ship as ed25519-signed gzip bundles. Agents verify the signature before applying indicators — offline cache keeps the last verified bundle.

  • No TLS decryption

    Enforcement is DNS-only. Blocked domains sinkhole to a local block page. No TLS inspection, PAC file, or network gateway in the policy path.

  • GDPR · DORA · NIS2

    Platform controls are mapped to GDPR, DORA, and NIS2. Audit evidence and the control-mapping pack are shared under NDA.

Questions about the architecture?

Book a 30-minute walkthrough — tenant isolation, device credentials, signed bundles, and audit exports.

Book a demo Get started