Skip to main content

Security

Security is central to ClearWIP. We handle financial data used for bonding and reporting, and we take our responsibility to protect it seriously.

Encryption

All data transmitted between your browser and ClearWIP is encrypted using TLS 1.2 or higher.

Data at rest is encrypted using AES-256 on managed cloud infrastructure.

Share-link and diagnostic tokens are stored only as SHA-256 hashes — the raw value leaves our systems once, when it is created. QuickBooks refresh tokens are encrypted (AES-256-GCM) with a key unique to each workspace, and QuickBooks access tokens are never written to disk at all.

Authentication

  • User authentication is handled by Firebase Authentication (Google LLC), which supports Google OAuth and email/password sign-in.
  • Passwords are never stored. Firebase Authentication manages credential storage and validation.
  • Signed-in requests carry short-lived Firebase ID tokens, and we check your workspace membership on the server for every request. A separate signed cookie (up to 14 days) remembers your sign-in and which workspace you had open.
  • Workspace data always requires sign-in and verified membership. The intentionally public parts of ClearWIP — shared report links, the demo, the QuickBooks health check, and OAuth callbacks — use narrow, expiring tokens instead.

Access controls

  • ClearWIP is multi-tenant, with the workspace as the boundary: every signed-in request is checked against your workspace membership. A small set of administrative routes is limited to authorized ClearWIP operators for support and operations, and every state-changing operator action lands in the audit log.
  • Within a workspace, people hold owner, admin, member, or viewer roles, each with its own permissions.
  • QuickBooks Online refresh tokens are stored encrypted and rotated per Intuit's token rotation policy; access tokens are short-lived and never persisted.
  • Production database access is restricted to authorized personnel and is logged.

Audit and monitoring

  • Material changes are recorded in an immutable audit log — period locks and unlocks, assumption submissions, member and role changes, QuickBooks connections and disconnections, sharing and billing events — and kept for at least 365 days.
  • Application-level security events are logged and monitored.
  • Sensitive values (tokens, passwords, financial data) are never written to logs.

Infrastructure

  • ClearWIP runs on Google Cloud managed infrastructure in the United States.
  • Databases are backed up daily, with a 7-day point-in-time recovery window.
  • Dependencies are regularly scanned for known vulnerabilities.

Reporting a vulnerability

If you discover a security vulnerability in ClearWIP, please report it responsibly to security@clearwip.com. We will acknowledge receipt within 48 hours and work to resolve confirmed issues promptly. We ask that you do not publicly disclose the vulnerability until we have addressed it.