Trust
Trust Center
Your catalog data stays yours. Here is how we protect it, what we are certified against, and who to ask when you need more information.
Compliance
Certified and compliant
ISO/IEC 27001:2022
Certified
Certificate (PDF)GDPR
Compliant
How we protect your data
Your data
You stay in control
You own your data
Your catalog data is yours. We process it to do the job and nothing else.
Scoped sub-processors
Every sub-processor works under a data processing agreement with the same obligations we take on toward you. Ask us for the current list.
Export any time
Export your product data whenever you need it. What happens to it when the contract ends is agreed when you sign.
Questions we get asked
Do you train AI models on our catalog data?
No. Your product data is never used to train shared or third-party models. It is processed only to run the jobs you ask for.
Where is our data stored and processed?
Your catalog data is stored in EU regions, encrypted at rest and in transit. Model calls are the exception. Most of them are processed outside the EU today, because the model we use most runs on a global service with no EU region. Those transfers are covered by Standard Contractual Clauses and supplementary measures in line with EDPB guidance.
Are you certified?
Yes. CommerceClarity is ISO/IEC 27001:2022 certified, so information security runs as an audited management system. An independent security assessment and penetration test was run in August 2026.
How do you handle access control?
Least-privilege internal controls, and a full audit trail.
What happens to our data when the contract ends?
You can export your product data at any time. Retention and deletion at the end of the contract are agreed when you sign. Without that clause, the account and its data are deleted when the contract ends.
Can you fill in our security questionnaire?
Yes. Send it over and we will complete it.
Who is liable for what the AI produces?
The AI Act splits the roles: CommerceClarity is the provider of the system, the customer is the deployer and stays responsible for what it publishes to the consumer. We do not take on the customer’s liability. What we do take on is making the output checkable: your rules score every output, anything uncertain goes to a human, and every run carries an audit trail showing which rules fired, where each value came from, and what the system flagged as a conflict.
How do we report a vulnerability?
Email security@commerceclarity.com with what you found and how to reproduce it. We will confirm we have it and tell you what we do about it.