EN
Start 30-day trial

Security

How ClearScreen handles tenant data

Trials and shared data live in the shared EU Supabase Postgres project (Paris); a paid workspace has its own Supabase project in the region chosen at purchase. Device agents enforce policy locally; the cloud edge holds policy, block events, and enrollment records, scoped by tenant under Spot Cloud B.V.

  • Spot Suite OIDC sign-in

    Console sign-in uses your Spot Suite account through Spot Suite OIDC at spot-cloud.spot-suite.com, with Microsoft Entra ID single sign-on on the Business plan. Device agents never see user passwords.

  • Tenant-scoped data

    Trials and shared data live in the shared EU Supabase Postgres project (Paris); a paid workspace has its own Supabase project in the region chosen at purchase.

  • Tenant-scoped data

    Policy, block events, and enrollment records are scoped to your tenant. Rows do not cross customer boundaries.

  • Data residency

    Trials run in the EU; a paid workspace runs in the region chosen at purchase, and its database is stored there. Whatever the region, shared bundle files (R2) and the hourly backup dump sit in Cloudflare object storage in Western Europe, not pinned to an EU jurisdiction. Operated by Spot Cloud B.V.

  • Audit logging and export

    Block events record device, domain, category, source, and timestamp. The Console exports the latest 25 events as CSV or JSON.

  • Hashed device credentials

    Managed agents authenticate with per-device csk_ API keys, sha256-hashed server-side. Keys are stored at 0600 permissions on the endpoint.

  • Signed indicator bundles

    Threat feeds ship as ed25519-signed gzip bundles. Agents verify the signature before applying indicators — offline cache keeps the last verified bundle.

  • No TLS decryption

    Enforcement is DNS-only. Blocked domains sinkhole to a local block page. No TLS inspection, PAC file, or network gateway in the policy path. On Linux, a blocked HTTPS site may show a browser certificate warning instead of the block page.

  • GDPR · DORA · NIS2

    Platform controls are mapped to GDPR, DORA, and NIS2. Audit evidence and the control-mapping pack are shared under NDA.

Questions about the architecture?

Book a 30-minute walkthrough — tenant isolation, device credentials, signed bundles, and the audit log.

Book a demo Start 30-day trial