Security at Clark
Security for your firm's data
A security review starts with the information your firm handles and the people who can access it. Review identity, permissions, and data handling with the Clark team before rollout.
Identity & authentication
Identity and account access
Authentication requirements, identity-provider support, account lifecycle, and deployment-specific configuration are confirmed before rollout. Bring your firm's sign-in requirements so the review can address how users join, authenticate, and leave.
What to check with your team
- Which identity provider and SSO configuration does your firm require?
- How will accounts be provisioned and removed as responsibilities change?
Access boundaries
Permissions and access
The review covers firm-user roles, approval authority, access boundaries, personnel access, and how access is removed. Include the people who prepare work, review it, and administer the proposed deployment when defining those requirements.
What to check with your team
- Who needs access to each engagement, and who can approve work?
- What access may Clark personnel need for support, and how is it managed?
Your data environment
Hosting and data handling
Hosting, encryption, data residency, subprocessors, and support access are documented for the proposed deployment. The deployment review is the place to confirm how those details meet your firm's requirements for client and engagement information.
What to check with your team
- Where will engagement data be hosted and processed?
- Which encryption controls and subprocessors apply to the proposed deployment?
The data lifecycle
Retention, deletion, and exit
Retention, deletion, and exit are part of the security review. Confirm the applicable terms with the Clark team alongside your firm's recordkeeping requirements, including what happens to engagement information when the relationship ends.
What to check with your team
- What retention periods and deletion processes apply to your data?
- What information can your firm export, and how is exit handled?
Security assurance
Security that holds up under audit
Clark has completed SOC 1® Type 2 and SOC 2® Type 2 examinations, is certified to ISO/IEC 27001, and supports HIPAA and GDPR requirements. Your data never trains a model.
SOC 1 Type 2
Controls relevant to customers’ internal control over financial reporting, covered by an independent SOC 1® examination.
SOC 2 Type 2
Security, availability, processing integrity, and confidentiality controls independently examined against the AICPA Trust Services Criteria.
ISO 27001
Certified to ISO/IEC 27001 for information security management.
HIPAA
Security and data-handling controls that support firms working with protected health information.
GDPR
Privacy, access, and data-handling controls that support GDPR-aligned processing.
See Clark in action
The peer review guarantee, in practice
Watch Ava prepare a workpaper, then trace every figure back to the source document, the change, and the approval.