Security
Security and data handling
What we hold, how it is protected, what we deliberately do not hold, and who else is involved. No borrowed badges and no claims about certifications this business does not have.
Where client data actually lives
The assistant runs on a computer in the client's own office, on the client's own email, calendar and accounting accounts. That is a deliberate design choice: their books, their customer list and their correspondence stay in their systems, and Clott Operations does not keep a central copy of them.
What we hold is the setup itself: configuration, the assistant's instructions, the documents needed to keep it running, and the passwords or keys it needs to work. Those live in an encrypted vault on a machine owned by this business.
Access
- Named accounts only. No shared logins, anywhere.
- Two-factor authentication on every account that offers it.
- Access to a client system is limited to what the work needs, and it is removed when the work ends.
- Client system access is granted by the client, in writing, before anything is touched. If they revoke it, the assistant stops.
Encryption
- Everything in transit runs over TLS.
- Backups are encrypted on the machine before they leave it, with a key held by this business. The storage provider holds ciphertext, not readable files.
- Credentials at rest are file-permission restricted and excluded from anything public.
Backups
Every protected machine is backed up nightly. The backup job is verified by an automated check that alerts when a machine misses a night or when an archive comes back materially smaller than usual, because a backup nobody checks is a guess. Restores are tested by hand from a real machine on a regular schedule, not assumed to work.
What we do not hold
- Card numbers. Payments are handled by the client's own processors.
- Social Security numbers or payroll records.
- Health records. If a client in a regulated field needs that, it requires a separate written agreement and a different hosting arrangement, and that is not offered today.
- Nothing is sold, rented or shared for advertising. Ever.
Third parties involved
These are the services that touch anything, and what each one sees. If this list changes, it changes here first.
| Service | What it does | What it sees |
|---|---|---|
| Vercel | Hosts this website | Page views and form submissions in transit. No client business records. |
| Supabase | Stores website form and assessment submissions | Name, email, phone and the answers someone types into the assessment or the assistant box. |
| Cloud storage provider, US-based | Encrypted backups | Encrypted archives. The encryption happens on the machine before upload, so the provider stores data it cannot read. |
| Retell and Twilio | The phone line, (619) 912-0662 | Call audio and transcripts handled by the telephony providers to run the assistant. |
| Anam | Avatar video for demonstrations | Session audio and video for demos only. No client records. |
| Email and the Google Business Profile | Correspondence. Business listing information is public by design. |
Certifications, stated honestly
Clott Operations is a sole proprietorship. It does not hold a SOC 2 report, ISO 27001, or any other independent security certification of its own, and this page will not pretend otherwise.
The infrastructure underneath does hold them. Website hosting and the cloud storage used for backups are provided by companies that maintain SOC 2 Type II certifications, and their own audit reports are available from them on request. That covers their layer, not this one.
If a buyer needs a security statement for their own review, ask and one will be provided in writing, describing the controls above rather than a logo.
If something goes wrong
If an incident is confirmed that affects a client's data, that client is told within 72 hours of confirmation, in plain language: what happened, what was exposed, what is being done, and what they should do. Bad news does not wait for a full investigation to finish.
Questions
Ask directly. stu@stuclott.com or call (619) 912-0662. Last reviewed November 2026.