Security
Last updated: 25 August 2026
Encryption in Transit
ClariFi uses HTTPS/TLS for data in transit between user devices and platform services.
Encryption at Rest
Data-at-rest is protected by managed PostgreSQL encryption on Render, TLS in transit, and application-level AES-256-GCM (authenticated encryption) for selected secrets — for example OAuth tokens, Meta connection tokens, payment integration credentials, and MFA TOTP secrets — using dedicated key material (`FIELD_ENCRYPTION_KEY` / related keys) configured in production. This is not whole-database application-level encryption.
QuickBooks Online / Intuit integration
ClariFi integrates with Intuit's QuickBooks Online APIs under the Intuit Developer Terms and App Partner Program. Connection uses OAuth 2.0. Scopes are limited to the accounting operations required for sync and optional governed write-backs (for example company read and accounting transaction access as configured in the Intuit Developer Portal).
- Access and refresh tokens are encrypted at rest with AES-256-GCM using
FIELD_ENCRYPTION_KEY. - Disconnect revokes the refresh token at Intuit and clears local token material. You can also request deletion of synced QuickBooks data from the integrations portal.
- ClariFi does not resell, rent, or use QuickBooks customer accounting data for unrelated advertising. Usage is limited to providing the ClariFi product features you enable.
- Intuit API traffic is classified and metered (Core vs CorePlus) for operational stewardship under the Intuit App Partner Program; call volume and budgets are monitored by operators.
Account Security and MFA
Multi-factor authentication (TOTP) is available for users to enable optionally in the portal security settings. Broader policy-based MFA enforcement for sensitive actions is being rolled out and is not universally required for all accounts yet.
Report Security
Where available, report retrieval through authenticated portal download is the primary option. Third-party channel delivery should be used only when requested.
Responsible Disclosure
Please report suspected vulnerabilities to security@bizclinic.africa with sufficient reproduction detail and affected environment information.