Our approach
Professional investors trust AllocClarity with their portfolio positions, mandates and reporting. We treat that information as confidential and design the Services to need as little of it as possible.
We never touch your funds
- AllocClarity is read-only. We never ask for, hold or have access to private keys, seed phrases or signing authority.
- We analyse wallets from public on-chain data. Linking a wallet address gives us no ability to move assets.
- We do not execute transactions. Anyone who asks you for keys or signatures on behalf of AllocClarity is not us; report it to team@allocclarity.com.
Infrastructure
- The platform and its databases run on cloud infrastructure in EU regions, with production isolated from development environments.
- The website is served by Vercel over HTTPS only, with HSTS and standard security headers.
- Infrastructure is defined as code and changes go through peer review.
Data protection
- All data is encrypted in transit with TLS 1.2 or higher.
- Data at rest, including databases and backups, is encrypted with AES-256.
- Customer portfolio data is logically separated per customer and never used to serve other customers.
- Databases are backed up daily, and backups are encrypted.
Access control
- Staff access to production follows least privilege and is granted only where needed for their role.
- Multi-factor authentication is required for all internal systems and cloud accounts.
- API keys are scoped per customer, can be rotated or revoked at any time, and are stored hashed.
- Access to production systems is logged and reviewed.
Application security
- Code changes are peer-reviewed before deployment.
- Dependencies are scanned automatically for known vulnerabilities.
- Secrets are kept in a managed secrets store, never in source code.
Reliability
- Services are monitored around the clock, with alerting on errors, latency and data-freshness issues.
- Risk scores and reports are versioned, so every historical output can be reproduced and audited.
Incident response
We maintain an incident-response process. If a security incident affects your data, we will notify you without undue delay and, where required, within 72 hours to the relevant authority, with what happened, what data was affected and what we are doing about it.
Compliance
- We process personal data in line with the EU and UK GDPR. See our Privacy Policy.
- Security documentation and questionnaires are available to customers and prospects under NDA.
Report a vulnerability
If you believe you have found a security vulnerability in AllocClarity, please email team@allocclarity.com with a description and steps to reproduce. Please give us reasonable time to fix the issue before disclosing it, and do not access other customers' data, degrade the Services or run automated scans against production. We will acknowledge your report within 3 business days and keep you updated. We do not take legal action against good-faith research that follows these guidelines.