Feature
Security and data handling in ClawAI
The concrete mechanisms behind ClawAI account and data security — Argon2 password hashing, rotating refresh tokens, RBAC, AES-256-GCM credential encryption, TLS and service isolation — described plainly, with no compliance claims.
All features · Last reviewed:
Accounts, sessions and role-based access
Passwords are hashed with Argon2; access tokens are short-lived, and refresh tokens rotate on every use so a stolen token is detectable. Every account carries a role and an explicit permission set, checked in the interface and again on every backend endpoint — role-based access control applied at both layers, not only in what the interface happens to show.
Credential encryption and encryption in transit
Provider and connector credentials are encrypted at rest with AES-256-GCM and are never returned to the browser. Transport is TLS from the browser to the edge, and TLS again between every internal service, with certificates verified at each hop — so a credential is protected both while stored and while it moves.
Service isolation, rate limiting, and what is not claimed here
Each backend service owns its own database and cannot read another’s, so a failure in image generation cannot reach your conversations; per-account rate limits protect both your allowance and the platform from runaway loops. ClawAI holds no compliance certifications today, and the hosted app sends requests to third-party model providers under their own terms — where that will not work for an organisation, a private deployment inside your own network, running open-weight models only, is scoped individually; contact us to discuss it. For a request that has to stay on hardware you control by default, see private and local deployment, linked below.
Questions people ask
- How are my passwords and login tokens protected?
- Passwords are hashed with Argon2. Access tokens are short-lived, and refresh tokens rotate on every use, so a stolen refresh token is detectable rather than silently reusable.
- How are my connected-tool credentials stored?
- Provider and connector credentials are encrypted at rest with AES-256-GCM and are never returned to the browser, whichever workspace connector they belong to.
- Does ClawAI hold any third-party compliance certifications?
- No — ClawAI holds no compliance certifications today. For a requirement the hosted app cannot meet, a private deployment inside your own network is scoped individually; see the local and private deployment use case, linked below.
Try it rather than take our word for it
Argon2 password hashing, rotating refresh tokens, RBAC checked on every backend endpoint, AES-256-GCM credential encryption, TLS at every hop and per-service database isolation — concrete mechanisms, described plainly, with no compliance certification claimed.