TRUST CENTER
Built to handle your revenue data with care
ClearSync connects your Stripe billing data to HubSpot. This page covers what we access, where it’s stored, who can reach it, and what happens if something goes wrong.
Last updated: October 28th, 2026
STRIPE ACCESS
Read-only billing data
DATA LOCATION
United States (Ohio)
ENCRYPTION
TLS in transit, AES-256 at rest
DPA
Available on request
BREACH NOTICE
Within 72 hours
SOC 2
Planned start: 2027
OUR APPROACH
Security principles
Three commitments that shape how ClearSync is built and run.
DATA FLOW
What data we read and where it goes
ClearSync sits between Stripe and HubSpot. Here’s the complete picture of how data moves.
What we never access
Full card numbers, CVVs, full bank account numbers, Stripe secret keys, HubSpot private content, passwords, or any data outside the defined integration scope.
TECHNICAL SECURITY
Encryption & infrastructure controls
How data is encrypted, who can access it, and where it lives.
COMPLIANCE
Compliance and data protection
Our DPA is available to all customers and prospects. It covers GDPR, CCPA, EEA Standard Contractual Clauses, and UK GDPR.
EEA & UK transfers covered
EEA Standard Contractual Clauses (Module 2 & 3) and UK GDPR Addendum are incorporated by reference. Governing Member State: Netherlands.
Subprocessors disclosed
Every subprocessor is listed on this page with its location, purpose, and the data it processes. Customers with a signed DPA get at least 10 business days’ notice of changes.
Data deletion rights
Customers can request full data deletion at any time via self-service account deletion or by contacting support@clearsync.ai.
SOC 2 status
We plan to start the SOC 2 process in 2027. In the meantime, our Information Security Policy is available under NDA on request at security@clearsync.ai.
Request our DPA
Our DPA is built on the Common Paper DPA Standard Terms v1.1. Share your details and we will send it over, ready for countersignature.
Get SOC 2 updates
We plan to start SOC 2 in 2027. Sign up for updates via email.
SUBPROCESSORS
Third-party services we use
ClearSync uses the following subprocessors to deliver the service. Customers with a signed DPA will be notified at least 10 business days in advance of any additions or replacements to our subprocessor list.
INFRASTRUCTURE THAT PROCESSES CUSTOMER DATA:
United States
BUSINESS AND SUPPORT TOOLS:
RESPONSE & CONTACT
Incident response and contact
How we respond to security events, and how to reach us.
INCIDENT RESPONSE TIMELINE
Within 1 business day
We acknowledge receipt of any reported vulnerability or security concern.
Within 2 business days
Initial severity assessment completed and communicated.
Within 72 hours
From becoming aware of a breach, affected customers are notified with what we know so far, including the categories of data involved and recommended next steps. Updates follow as the investigation continues, per our DPA and GDPR Article 33.
CONTACT