Security and trust
How Klarety keeps your data, code and keys safe, and what you control.
How your data, code and keys are protected, and which controls are in your hands. Written for the person deciding whether to trust Klarety, and for the admin who sets it up.
Where Klarety runs
- Klarety runs on AWS. Your Studios, queries, agents and apps run there.
- Your tables use an open format. stores tables in the open format, so your data is never locked into a format only Klarety can read.
- Studios are isolated. Each is secure and isolated, with disks encrypted at rest.
- Secrets are encrypted. Project secrets, connection credentials and AI tool sign-ins are encrypted with a managed key service.
Workspaces keep teams apart
A has its own projects, data, members and plan. Nothing is shared between workspaces, even when one person belongs to several. Leaving or being removed ends your access right away.
Roles decide who can do what
Every member has a : Owner, Admin or Member.
- Owners and admins run the workspace. Only they change the plan, see and manage API keys, see every credit transaction, restore or delete for good, and take agents live.
- Members work in the projects and data they have been given.
Projects have their own people. The project's owner can do everything, including delete it. A project admin can open its Studio, change its settings and manage its people. Someone with Use can open the Studio.
See Members and Project settings.
Data access
Owners and admins always reach all data. For everyone else, you choose what each person can see and change in Settings, Data access. Access can be given to a schema, a table, a folder or a connection, at one of these levels:
| Level | What the person can do |
|---|---|
| Know it exists | See its name, nothing more. |
| See its columns | See its structure, not its rows. |
| Read its data | Query and read the rows. |
| Change its data | Add, change and delete rows. |
| Change its structure | Change columns and layout. |
| Give this access to others | Pass the same access on. |
Access can have an end date, and you can Take back access at any time. Folders in object storage have their own Who can see this control.
See Data access.
Verify it's you
Some pages hold secrets: a project's keys, or the page where you create an API key. Before showing them, Klarety checks it is really you, even when you are signed in. Someone at an unlocked computer cannot read your secrets or create keys.
Sessions
SettingsSecurity & access lists every device signed in to your account and when it was last active. Select Sign out next to any session you do not recognise.
API keys
An lets your servers and apps call Klarety as the workspace and spend its credits, so keys are guarded closely:
- Only owners and admins can see and manage keys, and creating one asks you to verify it is you.
- A key is shown once, when created. Copy it to your own secret store.
- Each key has a Name, an Access level and an expiry date, so it can only do what it needs and stops on a date you choose.
- A key used from a web page must list its Browser origins, and browser keys can only read.
- The key is never sent with every request. It is exchanged once for a one-hour token, renewed as needed.
- A workspace has a limited number of active keys. To rotate, create a new key, move your code to it, then revoke the old one.
Revoking cannot be undone
Revoke key stops everything using it right away. Move your code to a new key first.
See Authentication.
Your AI sign-ins stay yours
In a Studio, each person can use their own Claude Code, Codex or Cursor subscription. You sign in once, in your own terminal, and the sign-in follows you to every project. It is encrypted with a key that belongs to you, kept outside the Studio, and opened only in the Studio where you are working. Nobody else can use it, even in a shared Studio.
Use your subscription only as its vendor's terms allow.
See Your AI sign-ins stay private.
Secrets and the app key
Project secrets (API tokens, passwords) are added in the project's settings and encrypted. Viewing them asks you to verify it is you.
A deployed app reaches the project's data with an app key that only the live app holds. It is never shown, in the app or in the Studio. If you think it has leaked, Rotate the app key: the old key stops at once and the app goes out again with a new one.
See Secrets.
A person approves what matters
- Agents ask first. An asks before changing anything important, and continues only after you choose Yes, continue. A draft agent does nothing until a workspace admin takes it live.
- AI deploys wait for you. When an AI asks to put a project live, nothing builds until a person selects Approve and deploy.
- You set the Studio's internet. When creating a project you choose whether its Studio can reach the whole web, only your connections and the sites you add, or nothing outside Klarety.
Undo and restore
Tables keep their history, so you can go back to an earlier version. Deleted tables can be restored for a while, and deleted files go to the trash first. Only owners and admins can restore or delete for good.
See Undo and restore.
Next steps
- Members: invite your team and set roles.
- Data access: decide who sees which data.
- Authentication: use API keys from code.