Security Policy

Last updated: October 12, 2026

This policy describes how Clover Digital LLC ("we," "us," or "our") protects the systems that run Clover and the data our clients trust us with, including data from the accounts they connect to Clover, such as Google, Microsoft, Dropbox and TikTok Shop. It applies to everyone who works on Clover and to the AI agents and automated systems we operate. Our Privacy Policy explains what data we collect and how we use it.

Ownership and Review

A Clover Digital cofounder serves as our security lead. The security lead owns this policy, approves access to our systems, coordinates incident response, and reviews this policy at least once a year and after any security incident. Questions and security reports go to hello@cloverdigital.com.

Data Classification

Client confidential: data from clients' connected accounts, the authorization tokens those providers issue, client files and records, and personal data about our clients' own customers (for example, buyer details on a TikTok Shop order).
Internal: our own business records, source code and system configuration.
Public: material we publish, such as this website.

Client confidential data is stored and processed only in approved systems located in the United States. We do not sell it, use it for advertising, or use it to train AI models, and we share it only as our Privacy Policy describes. When we receive personal data our clients' work does not need, such as a buyer's name, phone number or address, we drop it before it reaches Clover's AI processing.

Encryption

In transit: all connections between connected-account providers, Clover and our AI providers use HTTPS (TLS).
At rest: client confidential data is stored only on encrypted storage. Our database and hosting providers encrypt stored data at rest, and the computers we use for Clover work use full-disk encryption.
Authorization tokens: tokens issued by connected-account providers are additionally encrypted by Clover with AES-256-GCM before they are written to storage. They are used only by Clover's own systems and are never given to AI providers.

Access Control

Access follows least privilege: people and systems get only the access their work requires.
Each client's Clover can reach only that client's connected accounts. Our systems enforce this separation for every request.
Clover Digital staff do not read client confidential data unless the client asks us to for a specific item, we need to for security or abuse investigation, or the law requires it.
Everyone uses their own accounts. Shared logins are not allowed. Credentials and keys are kept in a password manager or our hosting providers' secret storage, never in source code, chat messages or logs.
The security lead approves new access, removes access the same day someone leaves or no longer needs it, and reviews who has access at least every six months.

Accounts and Devices

Multi-factor authentication is required on company email, source code, hosting and database accounts.
Computers used for Clover work must have full-disk encryption, an automatic screen lock that requires a password, automatic security updates, the operating system's firewall and built-in malware protection turned on, and automatic login turned off.
Lock your screen when you step away, and do not leave client information visible, printed or unattended.

Networks and Hosting

Clover's production services run on managed hosting and database providers in the United States, separate from our office networks. Internet-facing services accept HTTPS only and require authentication for anything beyond public pages. Our internal machines do not accept inbound connections from the public internet; we reach them only over private network connections. We monitor our services for errors and unusual activity.

Vulnerability Management

Automated dependency vulnerability alerts and security updates are enabled on all of our code repositories.
We fix critical and high-severity vulnerabilities in code we run within 30 days of learning about them, sooner when they are being exploited.
Operating system security updates install automatically on our computers. Servers are updated at least monthly.
Code changes are reviewed and tested before they reach production.

Incident Response

Anyone who suspects a security incident reports it to the security lead immediately. The security lead then:

contains the incident, for example by revoking tokens, disconnecting affected accounts or rotating keys;
investigates what happened and what data was affected;
fixes the cause and records the incident and what we changed.

We notify affected clients, and any platform whose data is involved (such as TikTok Shop, Google, Microsoft or Dropbox), without undue delay and no later than 72 hours after we confirm an incident affecting their data. We also give any notice the law requires. After every incident we review this policy and our controls.

Data Retention and Deletion

We keep client confidential data only while we need it to provide Clover. A client can disconnect an account at any time. We delete connected-account data within 30 days of a client's request and within 30 days after their Clover service ends. We help our clients, and the platforms they connect, respond to their users' requests to access, correct or delete personal data.

Service Providers

We use hosting, database and AI service providers that protect data with encryption and access controls. AI providers process data only on our behalf, under terms that do not allow them to train their models on it.

Contact Us

To report a security concern or ask about this policy, contact us at:

Clover Digital LLC
hello@cloverdigital.com