Clawvisor procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “ For the cloud service, you may request access to, correction of, or deletion of your personal data by emailing support@clawvisor.com. For self-hosted instances, you have direct access to all your data. If you are located in the European Economic Area (EEA) or the United Kingdom, you have additional rights under the General Data Protection Regulation (GDPR), including the right to access, rectify, erase, restrict processing, data portability, and object to processing of your personal data. Our legal bases for processing are: performance of our contract with you (providing the Service), and legitimate interests (security, fraud prevention, and service improvement). The cloud service infrastructure is hosted in the United States on Google Cloud Platform. Transfers of personal data from the EEA/UK to the United States are governed by Google's Data Processing Addendum, which incorporates Standard Contractual Clauses (SCCs) approved by the European Commission. To exercise your rights, contact support@clawvisor.com.” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ For the cloud service, either party may terminate at any time. We may suspend or terminate your access if you violate these Terms. Upon termination, your data will be permanently purged within thirty (30) days, except where retention is required by applicable law. You may request immediate deletion by contacting support@clawvisor.com.” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Cloud service: Your data is retained while your account is active. Upon account deletion, all associated data — including credentials, audit logs, agent configurations, and account information — is permanently purged within thirty (30) days, except where retention is required by applicable law. You may request deletion at any time by contacting support@clawvisor.com. Audit logs: Audit logs on the cloud service are retained for the lifetime of your account. You may export or request deletion of your audit history at any time. Authentication sessions: Authentication session cookies expire according to the configured session lifetime, and are cleared or invalidated when you log out or when the session is revoked or expires. LLM proxy artifacts: Raw LLM request bodies, raw LLM response bodies, and full model streams are not persisted. Redacted audit logs and sanitized operational trace/debug logs may be retained as described in Section 2a. Pending approvals, nonces, resolver state, and similar short-lived proxy state are deleted when no longer needed for the approval, stream, request, or related operational process. Self-hosted: You control data retention entirely. Expired sessions, pending approvals, and chain context facts are cleaned up automatically by background processes within your instance.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “This includes prompts, conversation history, tool definitions, tool calls, tool results, model outputs, and streaming chunks as needed to provide the proxy. Clawvisor's non-persistence promise for raw LLM request bodies, raw LLM response bodies, and full model streams is described in Section 2a. The provider's handling of data after it receives proxy traffic is governed by that provider's privacy terms, data processing terms, and account settings. ” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ The cloud service uses the following sub-processors to deliver the Service: Google Cloud Platform — Cloud infrastructure and data processing. Resend — Email delivery. Telegram — Notification delivery. Ploy — Marketing website hosting and analytics. Plausible Analytics — Website analytics. ” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Clawvisor interacts with third-party services only when you configure it to, whether on the cloud service or a self-hosted instance: External APIs (Google, GitHub, Slack, etc.) are called on your behalf when agents make requests. You register your own API credentials with each provider. Data exchanged with these services is subject to their respective privacy policies. SAML identity providers: If you configure SAML SSO, authentication requests are sent to your organization's identity provider. We store the IdP's entity ID, SSO URL, and signing certificate to validate responses. Your email address is extracted from the SAML assertion. Telegram is used for approval notifications if you configure a bot. Message content includes service names, actions, and truncated parameters. Resend is used for email verification on the cloud service. Your email address is shared with Resend to deliver verification messages. Cloud relay and push: Local daemon installations connect to the Clawvisor cloud relay by default, and push notifications are enabled when you pair a mobile device. Data handling for these services is described in Section 3a. Clawvisor internal AI features: If you enable optional intent verification or task risk assessment, Clawvisor uses AI models to evaluate agent requests. For intent verification, only request metadata (service, action, parameters, and agent-provided reason) is sent to the model. ” | Captured 2026-07-20Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.