How ClarityPath protects your case

Every parent's case file is isolated to their own account. There is no cross-account visibility: incidents, uploads, drafts, and AI conversations are scoped to the account that created them, and every API request is authorized against that scope on the server.

Attorneys never get access by default. A parent must explicitly invite their attorney, and access is granted only when the attorney accepts that invitation. The parent can revoke access at any time — revocation immediately cuts off the attorney's access to the live case file, and edits made by an attorney are always attributed to the attorney, never blended into the parent's own record.

After revocation, the attorney retains a read-only, frozen snapshot of only what was shared while access was active — reflecting that the attorney was part of the legal record during that period. The snapshot never updates with new case activity.

Attorney accounts are a separate authentication system from parent accounts, so a compromise of one portal's session cannot be replayed against the other.

All traffic between your browser and ClarityPath is encrypted with TLS. There are no unencrypted endpoints.

Stored data — the database and uploaded files — is encrypted at rest by our infrastructure providers (Replit, backed by Google Cloud Platform). Uploaded evidence files live in Google Cloud Storage and are only served through authenticated, authorization-checked application routes; there are no public file URLs.

ClarityPath's AI features are powered by OpenAI's API. Your case data is sent to OpenAI only to generate the analysis or draft you requested — it is never used to train or improve any AI model, by us or by OpenAI. OpenAI is contractually prohibited from training on API-submitted data.

We do not sell, rent, or share your case data for advertising or any purpose other than operating the Service.

Parent accounts are managed by Clerk, a dedicated authentication provider. Sign-in is available via Google (OAuth) or email with verification codes; when passwords are used, they are checked against known breach databases and never stored by Clarity Path LLC.

Sessions use short-lived, signed tokens that are re-verified on every API request. Attorney portal sessions are separate and independently expired and revocable.

Actions taken by an attorney in a shared case are recorded with attorney attribution, so a parent can always distinguish their own entries from their attorney's suggestions and edits.

Server-side request logs capture authentication and access events for operational security and incident investigation.

You can request deletion of your account and all associated data at any time by emailing us; deletion is completed within 30 days of your request. Files you delete are removed from active storage within 30 days, and residual copies in encrypted backups are purged within 90 days.

You can download your uploaded evidence files as organized ZIP archives from within the app, and you can request a copy of your other records by email — no retention lock-in, no data held hostage.

Our privacy practices are designed to align with California's CCPA and Washington State's My Health My Data Act. See our Privacy Policy for the full details of what we collect and why. Read the Privacy Policy →

ClarityPath does not currently hold third-party certifications such as SOC 2 or HIPAA. We would rather tell you exactly what we do than display a badge we haven't earned — if your firm has a security questionnaire, we're happy to complete it.