Your data – your organisation record, your RoPAs, DPIAs, evidence files, dossiers and activity history – is stored only in Frankfurt, Germany. The database, the file storage and the sign-in system are all located there, and the application itself runs in the same region.

Regional hosting does not, by itself, determine the legal basis for an international data transfer. Klari is completing the Nigeria-to-Germany transfer assessment and any required terms or approvals with Nigerian privacy counsel. Before a customer signs or starts processing Tenant Data, we will provide the then-current supplier, location and transfer information for that engagement.

One disclosure for completeness. The routing layer that decides whether a request belongs to this marketing site or to the product runs close to you rather than in Frankfurt, and reads your session token in order to make that decision. It never reads, writes or stores a compliance record.

Klari is multi-tenant, and separation between organisations is enforced by the database itself rather than by application code that could be bypassed. A user who belongs to one organisation cannot read, change or even count another organisation's records.

That separation is not taken on trust internally either. An automated test suite creates two separate organisations and asserts, on every single change to our codebase, that neither can reach the other's data. If it fails, the change does not ship.

Within your own organisation, access follows the role you assign – owner, administrator, member or read-only viewer – and authority to sign off an assessment is granted person by person, separately from role, so it rests only with the people you appoint to it.

Every action that changes your compliance data is recorded: who did it, what they changed, what it looked like before and after, and when. That record is write-once. Entries cannot be edited or deleted afterwards – not by you, not by another user, and not by Klari. The database refuses it.

This is the difference between a system that logs activity and one that can evidence it. An activity history you could quietly tidy up before an inspection is not evidence of anything. Your DPO reads this history as part of normal work; it is a product surface, not a hidden diagnostic.

Files you upload – evidence, appointment letters, generated dossiers – are held in private storage. They are never publicly addressable. Access is granted through short-lived links that expire fifteen minutes after they are issued and are re-issued on each download.

We do not present the current storage service as WORM or immutable evidence storage. When evidence is deleted, it is removed from the working product; no self-service restore window is promised. Retention, deletion and any backup handling are governed by the customer’s agreed terms and applicable law.

Every PDF Klari produces – RoPA, DPIA, NDPC submission, appointment letter, CAR dossier – carries a SHA-256 fingerprint of the data it was built from, printed on the cover and in the footer of every page. Generate the document again from unchanged data and the fingerprint is identical. Change a single field and it is not. Anyone holding the document can check that for themselves.

Stated plainly, because the distinction matters: these are tamper-evidence fingerprints, not digital signatures. Klari applies no PKI signature to any document. A fingerprint proves a document matches the data it was rendered from. It does not prove who produced it, and we do not claim it does.

Klari relies on a small number of third-party providers to operate the service. None is used for advertising, analytics or profiling, and we disclose the supplier and intended processing region below so customers can carry out their own diligence.

The service region does not by itself determine a supplier's corporate jurisdiction or the legal transfer mechanism. Customer-specific supplier and transfer terms are provided before contracting.

• Supabase — database, file storage and sign-in – Frankfurt, Germany
• Vercel — application hosting – Frankfurt, Germany
• Resend — transactional email – Ireland
• Sentry — error monitoring – Frankfurt, Germany
• Upstash — rate-limit cache – Ireland
• Cloudflare — domain and inbound-mail routing – global edge routing metadata

The current versioned list is available in the Trust Centre when published and on request from security@klari.ng. Where an addition materially changes data location or the category of access, customers receive at least 14 days' notice and can object in writing.

Security reports go to security@klari.ng and we aim to acknowledge them within one business day. For personal data breach reporting under the NDPA 72-hour requirement, write to privacy@klari.ng and we will route the notification to the customer's DPO of record.

Set out here so a procurement team can plan around it. Nothing below is hidden behind a form or a paywall.

• No penetration test has been commissioned. We intend to book a first engagement before signing a Tier-1 customer, and to repeat it annually.
• No SOC 2 or ISO 27001. SOC 2 Type II is targeted for FY2027; we will engage an auditor once a customer requires it and we have a twelve-month operating history. ISO 27001 is sequenced after it.
• No service level agreement in force. Availability is monitored by an external service every five minutes, and the history is public on our status page. A target and service-credit schedule applies only where a customer's order form incorporates it, and none does yet.
• Single sign-on and two-factor authentication are supported by our platform and will be enabled when a customer requires them.
• Customer-managed encryption keys and write-once evidence storage will be implemented where contracting requires them.

If your procurement needs any of these before signing, write to security@klari.ng with your requirements and timing and we will agree a delivery commitment as part of the contract. Published versions will carry a version number and fingerprint in our Trust Centre.

Our MSA is drafted and in legal review. It is not yet posted for self-service download – request the current counterpart from hello@klari.ng and we will send it. Negotiated counterparts are welcome for any procurement that requires bespoke terms; send redlines to the same address.