Security and SSO

Data residency, single sign-on, MFA, audit logs, and how Clment handles your contracts.

Updated 17 Aug 2026

Contracts are sensitive. This page covers how Clment handles your data, the auth options available, and where to look for an audit trail.

Data residency

Clment runs as a set of regional planes. Each region keeps its stored data physically within that region — contracts uploaded into a US org are stored within the US region and stay there at rest. The one exception is while an AI review is actually running: the analysis may run on AI models hosted outside your region, using temporary copies that are deleted shortly afterwards and are never used to train the models. Available regions:

  • US — Azure East US 2.
  • EU — Azure Germany West Central (Frankfurt). AI inference for this region runs in Sweden Central, so both storage and processing stay inside the EU.
  • UK — Azure UK South (London).
  • AU — Azure Australia East (Sydney).
  • NZ — Azure New Zealand North (Auckland), for in-country residency.

Backups are geo-redundant within the same geography. New Zealand is the exception: Azure has no second New Zealand region, so NZ backups are zone-redundant within New Zealand North, plus an offsite copy held with a New Zealand provider rather than shipped abroad.

Cross-region work — like a multi-region admin viewing usage stats — happens via aggregated metadata only; the underlying contract data stays in-region.

Single sign-on (SSO)

Clment supports two SSO providers out of the box:

There’s no self-service SSO screen: you register the app with your identity provider, then raise a support request (Help & support → Contact support) and the Clment team switches it on for your organisation. Registering the app takes about 15–20 minutes; the provider articles above walk it through.

Once SSO is configured, an admin can disable password sign-in for the whole organisation from the Sign-in methods card on Settings → Security — Disable for organization on the password row (or Disable password for organization, if you’re an SSO-only admin). Clment then rejects password sign-in attempts at the auth layer and routes users to your IdP.

User accounts are created via the Team page; the email you invite needs to match what the IdP returns at sign-in time. We don’t currently auto-create accounts from SSO sign-ins.

Multi-factor authentication

For non-SSO sign-in, MFA is optional on Free and enforceable org-wide on paid plans. Clment supports authenticator apps (Google Authenticator, Authy, 1Password, etc.) plus backup codes.

Org admins can require MFA org-wide from the Sign-in methods card on Settings → Security — Require 2FA for organization. Existing users without MFA are walked through enrollment on their next sign-in.

SSO-only users are exempt — their identity provider’s MFA policy applies. Forcing a second factor on top of an IdP’s existing MFA is redundant.

See MFA and account protection for the user-side walkthrough.

Encryption

  • At rest: Azure Storage Service Encryption is on by default for all storage.
  • In transit: TLS 1.3 (TLS 1.2 minimum). HSTS enabled on every public hostname.
  • Backups: encrypted with the same keys as the live data; retained 90 days.

Audit log

Every state-changing action against a contract or review writes an audit row. You can see the per-contract trail under the contract’s Activity tab. The trail includes the user, the action, the resource id, and the timestamp.

For SOC 2 / compliance evidence, contact support — we can produce an organisation-wide export covering whatever window you need.

Reporting a security issue

If you’ve found a vulnerability, please report it via our security page, which lists the disclosure contact and PGP key. We respond within 24 hours and follow coordinated-disclosure norms.

See also

Still have questions?

Instant article search