Security Guidelines

Data Storage

Store credentials securely

Please do not store API keys or other sensitive configuration values in source control or wiki pages. These secrets should be viewable only by parties who absolutely require it.

See the OWASP best practices page for more details on secure credential storage.

Do not cache or log sensitive data

Requests to and responses from the CLEAR API should not be cached or logged under any circumstances.

It is acceptable and encouraged to have operating system and application logs for debugging or security incident response. However, these logs must never include sensitive data such as selfies or Personally Identifiable Information (PII). Other sensitive values such as keys, credentials, or cryptographic values must also not be logged.

Data Transmission

Always properly validate SSL/TLS certificates.

Keep TLS software up to date.

TLS clients should only support secure protocols and ciphersuites. See Mozilla’s wiki page on secure TLS protocols and ciphersuites: “Modern Compatibility” is recommended but “Intermediate Compatibility” is acceptable if necessary. OWASP has a comprehensive best practices page for TLS and certificates in general.

Secure Software

Do not alter the Web SDK

The SDK is built to ensure the security of our users and uses specific practices to maintain security. The SDK is to be used as is and and not altered. You may not substitute custom code for the SDK without express permission from CLEAR. CLEAR reserves the right to audit uses of the SDK and ensure those uses have not been altered.