Security
Last updated October 15, 2026
How CloneKit protects your account, your kits and your money. This page lists only what is in place today.
How we protect your data
- Sign-in runs on Clerk. We never see or store your password.
- Stripe holds your card details. We keep only the card brand and the last 4 digits.
- We store API keys as hashes. A key is shown once, and you can revoke it at any time.
- Private kits are visible only to their creator. Creators see totals about their kits, never a buyer's answers or details.
- When your agent sends us answers during a run, we remove secrets such as API keys and passwords before we store them.
- We check the signature on every Stripe notification. The MCP server and the API limit how many requests one client can make.
- Analytics start only after you accept. We honor Do Not Track and Global Privacy Control, and we use no ad trackers.
- Our code is tested automatically on every change. The command-line tool is published to npm with provenance, so you can check it was built from our repository.
How we check kits
Every kit goes through automated checks for malware and attacks before it is published. We also send a sample of the kit to an AI model for a second look, and that request asks the provider not to keep the content. Paid kits, and any kit rated high risk, get a deeper check by agents before they can go live. No check guarantees that a kit is safe.
Where your data lives
CloneKit operates from the United States. Our providers store data mainly in the United States.
Subprocessors
These companies process data for us. Each one gets only what it needs for its job. We update this list when it changes.
| Vendor | Purpose | Location |
|---|---|---|
| Vercel | Hosting and server logs | Mainly the United States |
| Neon | Database | Mainly the United States |
| Clerk | Sign-in and accounts | Mainly the United States |
| Stripe | Payments and creator payouts | United States |
| PostHog | Product analytics, only after you accept | United States |
| Vercel AI Gateway and its AI model providers | Automated safety review of kits | Chosen by Vercel AI Gateway |
| Resend | Email about your account and purchases | Mainly the United States |
| Google Workspace | Company email and support | Mainly the United States |
Report a vulnerability
Found a security problem? Email us with what you found and how to reproduce it. We reply within 3 business days.
- Test only against your own account and data.
- Do not read, change or delete other people's data.
- Give us reasonable time to fix the problem before you share it.
- We do not run a bug bounty. We welcome good-faith research that follows these rules.
Certifications
CloneKit does not hold SOC 2, ISO 27001 or HIPAA certifications today. The certifications of our providers, such as Vercel, Neon and Stripe, belong to those providers and do not make CloneKit certified. CloneKit does not support protected health information, and it does not offer single sign-on.