Data Processing Agreement

Clarifi processes personal data on behalf of its Customers as a "Processor" under applicable data protection law (GDPR / UK GDPR / CCPA), with the Customer acting as the "Controller". This page is the public summary of the Data Processing Agreement (DPA); the signed long-form agreement is available on request, as set out below.

Scope

The DPA applies to Customer Data processed by the Clarifi platform, including financial transactions, account mappings, KPI computations, and audit logs. The Sub-processor list and the Standard Contractual Clauses (SCCs) for cross-border transfers are appended as Schedule 1 and Schedule 2 of the long-form agreement.

Controls and security

Clarifi maintains the security and operational controls listed on the security page, including AES-256 encryption at rest, TLS 1.3 in transit, role-based access, and audit logging of significant actions. SOC 2 Type II audit is underway. Until then, our security controls inherit from SOC 2 Type II–audited infrastructure (AWS).

Sub-processors

Clarifi uses a documented list of sub-processors for hosting, observability, and customer success tooling. The current list is appended to the long-form DPA (Schedule 1).

Request the signed long-form DPA

Customers and prospective customers can request the signed long-form DPA via the contact page below. We countersign and return within one business day.