The ClearMark Trust Center

ClearMark maintains a formal privacy compliance program designed to support compliance with applicable privacy and data protection requirements, including the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). The program incorporates documented policies, technical and organizational safeguards, privacy-by-design practices, data subject and consumer rights procedures, vendor oversight, and security controls. Applicability and specific legal obligations may vary based on the nature of the processing, the individuals involved, and the services provided.‍

No. ISO/IEC 27001:2022 is an information security management system standard; it is not a certification of compliance with the GDPR, CCPA, or CPRA. ClearMark addresses privacy-law obligations through its privacy compliance program, while its ISO/IEC 27001:2022 certification provides independent assurance regarding the establishment, implementation, maintenance, and continual improvement of its information security management system within the certified scope.

ClearMark maintains procedures for responding to applicable privacy rights requests. Depending on the law and circumstances, these may include rights to access or know, correct, delete, obtain information about certain disclosures or processing, opt out of certain sale or sharing activities where applicable, limit certain uses of sensitive personal information where applicable, and exercise other rights provided by law. Requests are handled in accordance with applicable law, identity-verification requirements, and permitted exceptions. Please see the ClearMark Privacy Policy for current instructions and details.

ClearMark uses customer information in accordance with its customer agreements, Data Processing Addendum, Privacy Policy, and applicable law. For ClearMark's current disclosures concerning the sale or sharing of personal information and applicable privacy choices, please refer to the Privacy Policy.

ClearMark may use vetted service providers and subprocessors to support operation of the ClearMark Services. ClearMark applies vendor oversight and contractual, privacy, and security requirements appropriate to the services provided. Additional information is available through ClearMark's Trust Center and applicable contractual documentation.

Yes. ClearMark is certified to ISO/IEC 27001:2022 for the information security management system (ISMS) within the scope stated on its certificate. The certification was issued following an independent conformity assessment. ISO/IEC 27001:2022 specifies requirements for establishing, implementing, maintaining, and continually improving an ISMS and for managing information-security risks through a systematic, risk-based approach.

The authoritative scope is the scope stated on ClearMark's current ISO/IEC 27001:2022 certificate and associated certification records. Certification should not be interpreted as covering systems, entities, locations, products, or services outside that defined scope. Customers requiring scope details or verification documentation may contact ClearMark through the Trust Center or security contact.

No. ISO/IEC 27001:2022 certification provides independent assurance that an organization has implemented an ISMS meeting the standard's requirements within the certified scope. It does not guarantee that security incidents, vulnerabilities, or other risks can never occur. ClearMark uses a risk-based security program and continually evaluates and improves its controls as threats, technology, and business requirements evolve.

ClearMark maintains its ISMS through ongoing risk management, control operation, monitoring, internal governance, corrective actions, and continual improvement. Certification is subject to the applicable certification lifecycle, including ongoing independent oversight and reassessment in accordance with the certification body's requirements.

ClearMark has implemented a security and controls program aligned with the applicable AICPA Trust Services Criteria and is undergoing an independent SOC 2 Type II examination. Until the examination is completed and the report is issued, ClearMark does not represent that it has completed or obtained a SOC 2 Type II report.

ClearMark has implemented a security and controls program aligned with the applicable AICPA Trust Services Criteria and is currently undergoing an independent SOC 2 Type II examination. ClearMark expects to complete the SOC 2 Type II attestation by December 31, 2026.

ClearMark uses layered technical and organizational safeguards designed to protect customer information, including encryption in transit and at rest, least-privilege access controls, secure authentication, monitoring, audit logging, vulnerability management, and other controls appropriate to identified risks. Specific controls may vary by system, service, and risk context.

ClearMark maintains vulnerability-management practices and uses independent security testing as part of its assurance program. Testing results are evaluated and remediation is prioritized based on risk. Because detailed vulnerability information may itself be security-sensitive, the availability and level of supporting documentation may be subject to confidentiality and security restrictions.

ClearMark uses logical access controls designed to restrict access so users and customers can access only information they are authorized to view. Access controls are managed according to role, business need, and least-privilege principles.

ClearMark maintains documented security incident response processes designed to identify, assess, contain, investigate, remediate, and recover from security incidents. Where required, ClearMark addresses customer, regulatory, or other notifications in accordance with applicable law and contractual obligations.

ClearMark applies identity and access management controls designed around least privilege, appropriate authentication, authorization, and access review practices. Administrative and privileged access is restricted according to business need and security requirements.

ClearMark does not use Customer Personal Data to train, fine-tune, evaluate, or improve third-party artificial intelligence models, machine-learning models, large language models, foundation models, or generative AI systems operating outside the ClearMark Services. Additional information regarding ClearMark's approach to AI and data use is available in the Responsible AI Statement and applicable customer agreements.

ClearMark may make appropriate security, privacy, certification, and assurance documentation available to customers or prospective customers based on the nature of the request and subject to confidentiality, security, contractual, and distribution restrictions. Requests may be submitted through the ClearMark Trust Center or to the appropriate ClearMark contact.

Please contact security@clearmark.ai. ClearMark appreciates responsible disclosure and evaluates reported security concerns in accordance with its security processes.

For additional information, please see the Security Statement, Responsible AI Statement, Privacy Policy, Terms of Use, Data Processing Addendum, Subprocessor information, and other resources made available through the ClearMark Trust Center.