Snapshot 96759
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Skip to main content This page covers the security-relevant features available in the ClarityQ product. Certifications and policies (SOC 2, GDPR, sub-processor lists) are maintained outside the product — reach out to your ClarityQ contact for the current documentation. Authentication ClarityQ uses Auth0 for identity. The following sign-in methods are supported: Email and password — Standard email-based sign-in. Google sign-in — One-click sign-in for organizations using Google Workspace. SAML SSO — Federated sign-in through your identity provider (Okta, Azure AD, OneLogin, or any SAML-compliant IdP). When enabled, ClarityQ provisions new users automatically the first time they sign in through your IdP — there’s no separate invite step. To enable SAML SSO for your organization, contact your ClarityQ team. Once configured, the Invite User button on the User Management page is replaced with an SSO Enabled badge. Access Control Permissions are enforced by role. Every API call and UI action checks the calling user’s role against the permission required by the action. Roles can be assigned org-wide and overridden per workspace. Programmatic access uses workspace-scoped API keys. A key carries no role of its own and reaches only ClarityQ’s public API endpoints, not the rest of the product. Keys expire after a year by default and each has a daily prompt limit. They’re created, listed, rotated, and revoked under Organization Settings → API, which is Admin only. Per-user data permissions. Roles decide which features a person can use, not which rows they can see. When your data warehouse already enforces row-level access, a connection can run each query under the asking user’s own warehouse identity instead of the shared service account, so those grants, row filters and masks apply inside ClarityQ too. This is available for Databricks and Trino, and the two work differently. With Databricks, each person connects their own account once under Settings → Apps. With Trino, nothing is asked of the user — ClarityQ runs the query as them using the service connection, provided Trino allows that impersonation. Either way, results are cached per user and shared dashboards resolve per viewer. Data Handling Warehouse connections — ClarityQ reads from your data warehouse using the credentials you provide during warehouse setup. Credentials are stored encrypted and used only by the agent and discovery jobs. Mandatory filters — Apply org-wide rules that scope every query the agent runs (see Filters). User deletion — Removing a user permanently deletes their chats, saved queries, dashboards, and other personal content. There’s no recovery, so transfer ownership of anything the team still needs before deleting the account. Asking for More Audit logs, IP allowlists, region selection, and similar controls aren’t surfaced in the product UI today. If your organization needs any of these, reach out — we’ll let you know what’s available and what’s on the roadmap.