Clare AI runs entirely on infrastructure you control. Customer conversations, order lookups and your knowledge base are stored and processed on your server. The only data that leaves is the API call to your own AI-model provider — under your account, your keys, your data-processing agreement. In normal operation, Clare AI the company receives nothing.
| Data | Where it lives | Who can access it |
|---|---|---|
| Customer conversations | Your server | You and your team |
| Knowledge base & documents | Your server | You and your team |
| Order / account lookups | Your systems, queried live | You — data isn’t copied out |
| Prompts sent to the AI model | Your OpenAI / Anthropic account | Your provider, under your agreement and API terms |
| License payment | Stripe | Stripe, under its own terms — we never see card details |
| Telemetry back to Clare AI | None | The software contains no phone-home analytics. We see nothing. |
A SaaS support vendor asks you to trust their staff, their subprocessors, their breach response and their retention policies — because your customer data sits in their cloud. Self-hosting removes the vendor from the data path entirely. We are a deliberately small company, and the architecture is designed so that you don’t have to trust us with your data at all — there is nothing of yours on our side to breach, subpoena, or lose.
We do not currently hold SOC 2 or ISO 27001 certification. If your compliance framework requires certified vendors, note the difference self-hosting makes: the deployment runs under your existing server controls, so in many frameworks it is assessed as part of your own infrastructure rather than as a third-party data processor. Under GDPR and Malaysia’s PDPA, you remain the data controller; your AI-model provider is your processor under your own DPA; Clare AI never processes your end-customers’ data. Have a hard requirement? Ask us the awkward questions: hello@clareai.tech.
· Serve everything over HTTPS/TLS
· Keep API keys outside the web root, readable by the app only
· Set a monthly spend cap in your AI provider’s dashboard
· Put the admin console behind a VPN or IP allowlist
· Take regular server backups — the whole system is yours to back up
· Least-privilege database credentials for integrations
· Keep the human-approval step on for sensitive actions (refunds, account changes)
· Apply OS and PHP/runtime updates on a schedule
· Rotate API keys periodically and after staff changes
· Log admin-console access
Professional and Enterprise deployments ship configured along these lines; the checklist is published so self-deploying Starter customers get the same posture.
Send them over — a real person answers within 24 hours, and “we don’t know yet” is an answer we’re willing to give.