Security & Compliance

Security and compliance are top priorities for ClearEstate because they are fundamental to your experience with the product. ClearEstate is committed to securing your application’s data, eliminating systems vulnerability, and ensuring continuity of access.

ClearEstate uses a variety of industry-standard technologies and services to secure consumer data from unauthorized access, disclosure, use, and loss. All ClearEstate employees undergo background checks before employment and are trained on security practices during company onboarding and on an annual basis.

Security is directed by ClearEstate’s Chief Technology Officer and maintained by ClearEstate’s Security & Operations team.

Infrastructure and Network Security

Physical Access Control

ClearEstate is hosted on Google Cloud Platform. Google data centers feature a layered security model, including extensive safeguards such as:

  • Custom-designed electronic access cards
  • Alarms
  • Vehicle access barriers
  • Perimeter fencing
  • Metal detectors
  • Biometrics

ClearEstate employees do not have physical access to Google data centers, servers, network equipment, or storage.

Logical Access Control

ClearEstate is the assigned administrator of its infrastructure on GCP, and only designated and authorized ClearEstate operations team members have access to configure the infrastructure on an as-needed basis behind a two-factor authenticated virtual private network. Specific private keys are required for individual servers, and keys are stored in a secure and encrypted location.

Third-Party Audit

Google Cloud Platform undergoes various third-party independent audits regularly and can provide verification of compliance controls for its data centers, infrastructure, and operations. This includes, but is not limited to, SSAE 5-compliant SOC certifications and ISO 27001 certification. ClearEstate undergoes regular third-party independent audits on a regular basis and can provide its SOC-2 report upon request.

Intrusion Detection and Prevention

Unusual network patterns or suspicious behavior are among ClearEstate’s most significant concerns for infrastructure hosting and management. ClearEstate and Google Cloud Platform's intrusion detection and prevention systems (IDS/IPS) rely on both signature-based security and algorithm-based security to identify traffic patterns that are similar to known attack methods.

IDS/IPS involves tightly controlling the size and make-up of the attack surface, employing intelligent detection controls at data entry points, and developing and deploying technologies that automatically remedy dangerous situations, as well as preventing known threats from accessing the system in the first place.

ClearEstate does not provide direct access to security event forensics but does provide access to the engineering and consumer support teams during and after any unscheduled downtime.

Business Continuity and Disaster Recovery

Business Continuity

ClearEstate keeps multiple daily encrypted backups of data using point-in-time recovery on GCP. While never expected, in the case of production data loss (i.e., primary data stores lost), we will restore organizational data from these backups.

Disaster Recovery

In the event of a region-wide outage, ClearEstate will bring up a duplicate environment in a different GCP region. The ClearEstate operations team has extensive experience performing full region migrations.

Data Breach Security Procedures

Breach Detection

Breach will be identified via either our error monitoring service (Sentry), or directly from GCP, depending on which layer the breach occurs.

Response

Given the ClearEstate platform is a multi-tenant system, (i.e. it has one single database and single instance running its production application), a kill switch has been put in place for such an event and the site would immediately go into outage/maintenance mode. No more data or user access is possible in the above stated mode.

Mitigation of Damages

Once the system is suspended, an investigation can be performed on the data breach via our various error logs and monitoring services. A Google report and communication of the breach is also provided by Google to further aid the investigation. Once the issue is identified, we work on security measures to prevent a similar attack.

Data Preservation and Integrity

The data of our consumers remains safe as multiple daily backups are performed on our database. Furthermore, the ClearEstate platform uses data auditing of all it’s valuable entities. Ex: data on estates, consumer details, documents, assets & liabilities, user accounts and more. This mechanism allows us to track any change made to any of the data during the breach and allows us to revert the changes to their original state. Our legal and data privacy team will also assess the data breach notification requirements under applicable law to ensure that we are notifying the relevant data protection authorities within the set timelines.  Depending on the nature of the breach, there may also be an obligation to notify the individual data subjects impacted by it. In case of the latter, our legal team will work jointly with our communication department to draft any public communications related to the breach.

Data Flow

Data into System

The majority of data entry is performed directly inside the ClearEstate platform. All sensitive data (e.g. passwords, national identification numbers, etc) are encrypted using a bcrypt hashing function.

Data through System

Data is sent securely to ClearEstate via TLS to an HTTPS endpoint. All data is AES-256bit encrypted, both in transit and at rest. ClearEstate requires a valid JWT authentication token for access to it’s API.

ClearEstate’s latest SSL Labs Report can be found here.

Data Out of System

ClearEstate integrates with a variety of third-party tools so that users can safely interact with their financial institutions, manage their billing subscription and perform electronic document signatures. ClearEstate’s high standards for security and compliance also extend to its partner networks.

Data Security and Privacy

Data Encryption

All data in ClearEstate servers is encrypted at rest. Google Cloud Platform stores and manages data cryptography keys in its redundant and globally distributed Key Management Service. So, if an intruder were ever able to access any of the physical storage devices, the ClearEstate data contained therein would still be impossible to decrypt without the keys, rendering the information a useless jumble of random characters.

Encryption at rest also enables continuity measures like backup and infrastructure management without compromising data security and privacy.

ClearEstate exclusively sends data over HTTPS transport layer security (TLS) encrypted connections for additional security as data transits to and from the application.

Data Retention

ClearEstate retains consumer data for up to 7 years, or as determined by applicable law, from time to time.

Data Removal

All consumer data stored on ClearEstate servers is disabled upon a consumer’s termination of service and disablement of account after a 30 day waiting period. Data can also be deleted upon request at security@clearestate.com.

Resigned Employee Data Access

Once an employee leaves or is terminated by ClearEstate, access of their ClearEstate Google account is immediately revoked, in turn disallowing them further access to the ClearEstate platform.

Application Security

Single Sign-On

ClearEstate’s single sign-on (SSO) implementation prioritizes security. We aggressively monitor linked accounts and disable them with any reasonable sign that the account’s access has been revoked. SSO also improves user experience by streamlining login and improving access from trusted domains. ClearEstate currently offers SSO via Google Apps.

JSON Web Token

To facilitate user authentication through the web browser and improve identity management, ClearEstate offers JSON web token authentication as a standard feature to consumers on all its plans. JWT enhances user-based security and streamlines signup and login from trusted portals to enhance user experience, access management, and auditability.

REST API Authentication (API Key)

ClearEstate’s REST API uses JWT for authentication. Authentication tokens are passed using the auth header and are used to authenticate a user account with the API.

Email Security

The ClearEstate service includes email notifications and reports. Sender policy framework (SPF) is a system to prevent email address spoofing and minimize inbound spam. We have SPF records set through Dyn, our domain name service (DNS), and domain-based message authentication, reporting, and conformance (DMARC) set up for monitoring reports to prevent the possibility of phishing scams. 

Audit Controls

We know user administration is central to security and management, and auditing user logs is often the first step in both an emergency response plan and policy compliance requirements. All ClearEstate consumers get admin controls governing identity, access, and usage to keep their data safe, secure, and centrally managed.

Membership within ClearEstate is handled at the organization level. The system is designed so each user has a singular account that can be reused across multiple estate accounts (even those using SSO). Each ClearEstate user should have their own account and can choose their own personal preferences and notifications settings. Access to estates is dictated by role:

  • Executor
  • Beneficiary
  • Dependent
  • Advisor
  • Estate Professional

For any estate on a ClearEstate plan, the administration portal is the hub for seeing and managing users and usage. This portal can only be accessed by estate professionals. The member list includes the username, email, status, added date, teams, and role for each user. The admin or professional can revoke access by estate and change the user role. Additionally, the professional can request login and password history and revoke passwords and active sessions for any estate member user (executor/beneficiary/dependent) via request to ClearEstate Support.

In the audit log, all of the actions and relevant entities by user and event within the ClearEstate UI. Actions such as: logins, invites, sent emails, etc. And entities such as: assets, liabilities, documents and all personal information relating to estate members. All of which are listed chronologically by time and IP address so you’ll always have a view into your estate’s most recent history.

Secure Application Development (Application Development Lifecycle)

ClearEstate practices continuous delivery, which means all code changes are committed, tested, shipped, and iterated on in a rapid sequence. A continuous delivery methodology, complemented by pull request, continuous integration (CI), and automated error tracking, significantly decreases the likelihood of a security issue and improves the response time to and the effective eradication of bugs and vulnerabilities. 

Corporate Security

Malware and Internal Data Breach Protection

At ClearEstate, we believe that good security practices start with our own team, so we go out of our way to protect against internal threats and local vulnerabilities. All company-provided workstations run Rippling MDM for inventory management (MDM), which enables zero-touch deployment and enforces full-disk encryption, screen lock, curated application installations, password reinforcement, SSO and other security features.

Risk Management

All ClearEstate product changes must go through code review, CI, and build pipeline to reach production servers. Only designated employees on ClearEstate’s operations team have secure shell (SSH) access to production servers using MFA.

We perform testing and risk management on all systems and applications on a regular and ongoing basis. New methods are developed, reviewed, and deployed to production via pull request and internal review. New risk management practices are documented and shared via staff presentations on lessons learned and best practices.

ClearEstate performs risk assessments throughout the product life cycle:

  • Before the integration of new system technologies and before changes are made to ClearEstate physical safeguards
  • While making changes to ClearEstate physical equipment and facilities that introduce new, untested configurations
  • Periodically as part of technical and non-technical assessments of the security rule requirements as well as in response to environmental or operational changes affecting security

Contingency Planning

The ClearEstate operations team includes service continuity and threat remediation among its top priorities. We keep a contingency plan in case of unforeseen events, including risk management, disaster recovery, and consumer communication sub-plans that are tested and updated on an ongoing basis and thoroughly reviewed for gaps and changes at least annually.

Security Policies

ClearEstate maintains an internal wiki of security policies, which is updated on an ongoing basis and reviewed annually for gaps. An overview of specific security policies is available to ClearEstate consumers upon request:

  • Information Security
  • Risk Management
  • Security Incident Response
  • Vulnerability Management
  • Policy Management and Maintenance
  • Data Request
  • Change Management
  • System Access

Background Checks

ClearEstate conducts background checks for all new hires, including verification on the following:

  • Identity Verification
  • National Criminal Records Check
  • References
  • Education Verification
  • Driving Records
  • Media Searches
  • Employment Verification
  • Professional and Trade Accreditation
  • International Screening
  • Biometric Scanning

Security Training

All new employees receive onboarding and systems training, including environment and permissions setup, formal software development training (if pertinent), security policies review, company policies review, and corporate values and ethics training.

All engineers review security policies as part of onboarding and are encouraged to review and contribute to policies via internal documentation. Any change to policy affecting the product is communicated as a pull request, such that all engineers can review and contribute before internal publication. Major updates are communicated via email to all ClearEstate employees.

Disclosure Policy

ClearEstate follows the incident handling and response process, which includes identifying, containing, eradicating, recovering from, communicating, and documenting security events. ClearEstate plans include a dedicated estate professional who holds responsibility for consumer communication, as well as regular check-ins and escalations.

ClearEstate maintains a live report of operational uptime and issues on our status page.

Vulnerability Disclosure

Anyone can report a vulnerability or security concern with a ClearEstate product by contacting support@clearestate.com and including a proof of concept, a list of tools used (including versions), and the output of the tools. We take all disclosures very seriously, and once we receive a disclosure we rapidly verify each vulnerability before taking the necessary steps to fix it.

Other Resources

Compliance Certifications

ClearEstate believes in privacy by design and therefore leverages Vanta to enforce its ongoing compliance and privacy standards.

  • SOC2 Type I
  • SOC2 Type II

Otherwise, contact us for a copy of any report(s) you’re interested in reading (It’ll be less infuriating than your social feed.)