Built to pass security review
Supplier records, compliance documents, business-critical workflows: it's sensitive data, and Clover is built to protect it at every layer. This page is for the people who evaluate that for a living: the IT, security, and procurement teams doing due diligence.
Protection at every layer
The same posture summarized on the Platform page, laid out for an evaluator’s checklist.
SSO & identity
SAML 2.0 single sign-on integrated with Okta, Azure AD, Google Workspace, and other major identity providers. Your team authenticates through your existing IdP. No separate passwords, no credential sprawl.
Encryption in transit and at rest
AES-256 at rest. TLS 1.2+ in transit. Every API call, every file upload, every field of supplier data: encrypted on the wire and in the database.
Immutable audit trail
Every action (every workflow step, approval, document upload, field change, conversation) recorded in a hash-linked audit log with timestamps and user attribution. When the auditor asks, the answer is a click.
SOC 2 (in progress)
Clover is built to SOC 2 Trust Services Criteria across security, availability, and confidentiality. Formal Type II certification is on the near-term roadmap. Our security questionnaire responses (SIG Lite, CAIQ) are available on request.
You don't assemble the record. The work leaves it behind.
Because every process runs through Clover, every record carries its full history: who did what, when, and why, captured as the work happens rather than reconstructed later. The log is hash-linked and immutable, so history can't be quietly rewritten.
- Every step, approval, and exception recorded as it happens, not reconstructed later
- The record is tamper-evident: hash-linked and immutable, so history can't be quietly rewritten
- Full version history on every record: see each prior value and what changed it
Your data stays yours
The questions every review asks about data handling, answered the same way we answer them on a questionnaire.
- No AI training on your data. Your supplier data is never used to train models and is never shared with other customers. Clover processes your data in isolated, secure environments.
- Export anytime. You can export your supplier records, documents, and the full decision history at any time in standard formats. Clover is where the work runs, not a place your data gets locked in.
- Access is controlled. Role-based access controls and team-scoped data isolation: access is controlled at the company, team, and user level.
- Cloud-based, no on-premise footprint. Clover runs on enterprise-grade cloud infrastructure, with no on-premise deployment to manage or patch.
Security questions, answered directly
Yes. Clover runs on enterprise-grade cloud infrastructure and is built to SOC 2 Trust Services Criteria across security, availability, and confidentiality, with formal SOC 2 Type II certification on the near-term roadmap. It uses AES-256 encryption at rest, TLS 1.2+ in transit, SAML 2.0 single sign-on, and role-based access controls, and security questionnaire responses (SIG Lite, CAIQ) are available on request.
No. Your supplier data is never used to train models and is never shared with other customers. Clover processes your data in isolated, secure environments, and you retain full ownership and control of it.
Yes. Your data is yours. You can export your supplier records, documents, and the full decision history at any time in standard formats. Clover is where the work runs, not a place your data gets locked in.