Technical security policy
This translation is provided for accessibility. If versions differ, the Italian version prevails, without limiting rights granted by applicable law.
Version: 2026-10-18 · Controller: CLARYEL S.R.L.S., 22073 Fino Mornasco (Como), Italy, P.IVA 04258140138, amministrazione@claryel.it.
This public summary describes the technical and organisational measures we apply to the claryel.com website and related services (GDPR Art. 32). It is not a penetration-test report and does not guarantee absolute security.
Legal sources
Controller: CLARYEL S.R.L.S., 22073 Fino Mornasco, Como, Italy, P.IVA 04258140138, amministrazione@claryel.it. DSA hosting-platform duties are out of scope until a public forum is offered.
Local-first
Models, memory and automations can remain on the owner’s computer. Cloud services are optional components, not the owners of the local operating system.
Measures for the website and accounts
- Encrypted connections (TLS); protected session cookies; origin checks on requests that change data.
- Passwords are stored only as hashes and are never returned by the website’s interfaces.
- Session tokens are also stored as hashes; signing out and deleting the account revoke active sessions.
- Abuse protection with an application firewall and the anti-bot check of our infrastructure provider.
- Administrative permissions are separate from commercial roles and are granted only explicitly; the last active administrator cannot be removed.
- The database cannot be reached directly from the Internet: only the website application accesses it.
- Operational logs keep hashed network fingerprints, not plain IP addresses.
- Backups and retention periods follow our internal procedures; accounting records follow Italian law.
Reporting a vulnerability
To report a vulnerability in our computers, software or website, follow the procedure published on the Security page: vulnerability reporting procedure.
Contact for reports: amministrazione@claryel.it
Machine-readable contact (RFC 9116): /.well-known/security.txt
Please do not publish technical details or exploits in public channels before the fix is ready.