Security and privacy
Security and privacy controls
Learn about encrypted connector credentials, transport security, service boundaries, local-only routing, retention settings, and operational safeguards.
Last reviewed:
Connector credentials are protected at rest
Provider and connector API keys are encrypted with AES-256-GCM using a random initialization vector and authentication tag, then masked in API responses. Payment gateway tokens use authenticated encryption with row-bound associated data. These controls support precise credential-protection claims, not a blanket claim about every stored byte.
Explicit service and data boundaries
ClawAI separates service ownership and prevents one service from reaching directly into another service’s database. Requests cross authenticated HTTP boundaries or RabbitMQ events, while validation, authorization, rate limits, security headers, and audit records are applied at defined layers. Deployment configuration remains part of the security boundary.
Retention differs by data type
Files default to a thirty-day expiry unless an operator configures indefinite retention. Client and server logs use thirty-day database expiry indexes, while audit records and usage ledgers have no automatic expiry in their current schemas. People can delete conversations, memories, context packs, and files; account deletion is not currently self-service.
Provider processing is a deployment choice
Prompts and attachments sent to a cloud model are processed by that configured provider under its own terms. Local-only routing can keep model execution on local Ollama paths, but other enabled services may still involve external processors. Certifications, residency, regulatory compliance, and universal erasure guarantees require separate evidence and are not claimed here.
One request, an inspectable route
ClawAI evaluates the request and current policy before it selects an available execution path.
Evaluate
Read the task, available context, policy, and current eligibility.
Route
Select an active model path from the providers configured by the operator.
Compare
Use multi-model orchestration only when the chosen mode and allowance permit it.
Return
Stream the answer with visible model provenance and usage information.
Learn about encrypted connector credentials, transport security, service boundaries, local-only routing, retention settings, and operational safeguards.