Klarnow is designed around strict access boundaries, minimal data collection and visible ownership.
Client and application records are queried against the authenticated email. Access is available through Sign in with ChatGPT or a one-time code sent only to an email already attached to a Klarnow record. Team-only views have a separate authorised-email check.
Klarnow does not ask clients to create or reuse a password. Email codes expire in 10 minutes, work once and lock after five failed attempts. Requests are rate-limited without revealing whether an email exists.
Portal sessions expire after 12 hours. Browser cookies are HttpOnly, Secure and SameSite=Lax; the corresponding server token is stored only as a cryptographic hash and can be revoked on sign-out.
Traffic is served over HTTPS with strict transport, content-type, referrer, framing and browser-permission headers. Camera, microphone and location access are disabled for the public website.
If you believe you have found a security issue, email team@klarnow.co.uk with enough detail for us to investigate. Do not access or alter another person’s data.
