Security, privacy & trust at Clumcy, Inc.
This portal outlines our strict enterprise boundaries, read-only API connectors, zero database setup guarantee, and corporate data governance practices at clumcy.com.
Last updated · June 2026
How we protect enterprise data
Our security posture
Read-only API connectors
Clumcy interacts with your ERP (SAP, Oracle, NetSuite), CRM, and HR systems exclusively via read-only APIs. We cannot modify, insert, delete, or alter any customer production records.
Zero database setup needed
You never need to provide database super-user credentials or maintain complex ETL warehouses. Clumcy normalizes metrics on your scheduled pull cadence without database disruption.
Encryption in transit and at rest
All data in transit is protected using TLS 1.3 cryptographic protocols with strong cipher suites. Stored normalized metadata is encrypted using AES-256 standard encryption.
Tenant data isolation
Multi-tenant architectural boundaries ensure strict isolation between customer workspaces. Your organization's metrics and correlation reports are completely segregated.
Where we stand today
Compliance & Governance
GDPR In place
Compliant. Data Processing Addendum (DPA) available on request - email [email protected].
CCPA / CPRA In place
Compliant. Enterprise users can exercise access & deletion rights at any time.
SOC 2 Type II In place
Continuous audit controls and policy governance framework in place.
ISO 27001 On roadmap
Information security management system tracked alongside enterprise controls.
We don't display badges we haven't earned. Any change to our compliance standing is reflected here and dated above.
What we process, what we don't
Data handling
What we process
Workspace configuration (name, work email, organization), authorized read-only operational metric metadata from plugins, cadence synchronization logs, and generated root cause diagnostic summaries.
What we don't touch
We don't request raw database passwords. We don't execute write commands. We don't sell customer operational data or business metrics to any third parties.
Data Retention & Purges
Historical correlation data is maintained for the duration of your active enterprise subscription. Workspace deletion triggers permanent removal of all tenant workspace configurations, metadata logs, and generated correlation reports within 30 days.
Enterprise data sovereignty
Your rights & data deletion
Export workspace data
Export your normalized metrics and correlation analysis reports directly from your workspace dashboard.
Disconnect connectors
Revoke access to any connected ERP, CRM, or HR plugin instantly at any time.
Email privacy office
Submit DPA requests, vendor questionnaires, or data subject inquiries.
Security vulnerability reporting
Responsible disclosure
Email [email protected] with reproduction steps. We commit to acknowledging reports within 2 business days and collaborating during a standard coordinated disclosure window.
In scope: our orchestration platform, web application, API endpoints, and plugin synchronization infrastructure.
Commitment to transparency
Incident response
If we confirm an incident affecting customer operational data, we will notify designated administrative contacts within 72 hours with detailed impact analysis and remediation actions taken.
What's next for trust at Clumcy
On the roadmap
Dedicated VPC & GovCloud Deployments
Isolated cloud tenant environments for government and high-compliance enterprises.
Custom Air-Gapped Connectors
On-premises connectors for highly regulated internal SAP and Oracle instances.
Bi-Directional SIEM Logging
Direct streaming of audit logs into enterprise Splunk and Datadog systems.
Automated Continuous Trust Center
Real-time telemetry and public security status telemetry.
Need a DPA, security review, or vendor questionnaire?
Our security team responds within 1 business day. Enterprise buyers - we'll walk your infosec team through our architecture live.