Skip to main content
This page covers the security-relevant features available in the ClarityQ product. Certifications and policies (SOC 2, GDPR, sub-processor lists) are maintained outside the product — reach out to your ClarityQ contact for the current documentation.

​
Authentication

ClarityQ uses Auth0 for identity. The following sign-in methods are supported:
  • Email and password — Standard email-based sign-in.
  • Google sign-in — One-click sign-in for organizations using Google Workspace.
  • SAML SSO — Federated sign-in through your identity provider (Okta, Azure AD, OneLogin, or any SAML-compliant IdP). When enabled, ClarityQ provisions new users automatically the first time they sign in through your IdP — there’s no separate invite step.
To enable SAML SSO for your organization, contact your ClarityQ team. Once configured, the Invite User button on the User Management page is replaced with an SSO Enabled badge.

​
Access Control

Permissions are enforced by role. Every API call and UI action checks the calling user’s role against the permission required by the action. Roles can be assigned org-wide and overridden per workspace. Programmatic access uses workspace-scoped API keys, also subject to the role of the user who created them. Keys are created, listed, and revoked under Settings → API. Per-user data permissions. Roles decide which features a person can use, not which rows they can see. When your data warehouse already enforces row-level access, a connection can run each query under the asking user’s own warehouse identity instead of the shared service account, so those grants, row filters and masks apply inside ClarityQ too. This is available for Databricks and Trino. Users connect their own account once under Settings → Apps → Data Warehouse; results are cached per user and shared dashboards resolve per viewer.

​
Data Handling

  • Warehouse connections — ClarityQ reads from your data warehouse using the credentials you provide during warehouse setup. Credentials are stored encrypted and used only by the agent and discovery jobs.
  • Mandatory filters — Apply org-wide rules that scope every query the agent runs (see Filters).
  • User deletion — Removing a user permanently deletes their chats, saved queries, dashboards, and other personal content. There’s no recovery, so transfer ownership of anything the team still needs before deleting the account.

​
Asking for More

Audit logs, IP allowlists, region selection, and similar controls aren’t surfaced in the product UI today. If your organization needs any of these, reach out — we’ll let you know what’s available and what’s on the roadmap.