Compliance & Certifications

Last Audit: October 2024 | Next Audit: April 2025

At Clayva, we take compliance and data protection seriously. This page outlines our compliance certifications, standards we adhere to, and our commitment to protecting your data in accordance with global regulations.

Compliance Overview

Clayva maintains a comprehensive compliance program that encompasses multiple frameworks and standards to ensure the highest level of data protection and security for our customers worldwide. Our compliance team continuously monitors regulatory changes and updates our practices accordingly.

Certifications & Standards

SOC 2 Type II

Clayva has successfully completed a SOC 2 Type II audit, demonstrating our commitment to security, availability, processing integrity, confidentiality, and privacy. Our SOC 2 report is available upon request for enterprise customers.

ISO 27001:2013

We are certified under ISO 27001:2013, the international standard for information security management systems (ISMS). This certification validates our systematic approach to managing sensitive company and customer information.

GDPR Compliance

As a data processor and controller, Clayva fully complies with the General Data Protection Regulation (GDPR) for our European Union customers.

CCPA Compliance

Clayva complies with the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), providing California residents with required privacy rights and protections.

HIPAA Compliance

For healthcare organizations, Clayva can operate in a HIPAA-compliant manner with appropriate safeguards and agreements in place.

• Administrative safeguards implementation
• Physical safeguards for data centers
• Technical safeguards including encryption and access controls
• BAA execution with covered entities
• Employee HIPAA training program
• Incident response procedures for PHI

PCI DSS

While Clayva does not directly process payment card data, we maintain PCI DSS compliance for our payment processing partners and ensure secure handling of any payment-related information.

• Level 1 Service Provider compliance through partners
• Tokenization of payment information
• No storage of card verification codes
• Regular security scanning and testing

Data Residency

Clayva offers flexible data residency options to meet your geographic and regulatory requirements:

Audit & Compliance Logs

Clayva maintains comprehensive audit logs for all data access and administrative actions:

• User Activity Logs: All user actions including login, data access, and configuration changes
• Administrative Logs: System administrator activities and privilege escalations
• API Access Logs: All API calls with timestamps and parameters
• Security Event Logs: Failed authentication attempts, permission denials
• Data Export Logs: Records of all data exports and downloads
• Retention Period: Minimum 2 years for compliance purposes

Data Processing Agreements

We offer standard Data Processing Agreements (DPAs) that comply with GDPR Article 28 requirements:

Subprocessors

We work with carefully selected subprocessors to provide our services. All subprocessors are bound by data protection agreements and undergo regular security assessments.

Notification of Changes: We provide 30 days advance notice for any additions or changes to our subprocessor list via email to the primary account contact.

Incident Response

Our incident response plan ensures rapid detection, containment, and resolution of security incidents:

Compliance Contacts

Resources & Documentation

Access our compliance documentation and resources: