Security at CleverX

Last updated 16 October 2026

This page explains how to report a security problem to us and how we protect the data in CleverX. CleverX is operated by BluMatter, Inc.

Report a vulnerability

Email [email protected] with “Security” in the subject, a description of the issue, the steps to reproduce it, and what an attacker could do with it. We aim to acknowledge reports within three business days and to keep you updated until the issue is resolved. We don't currently run a paid bug bounty.

In scope: cleverx.com and its subdomains, including the CleverX app, our API, and our MCP server for AI tools at mcp.cleverx.com. Problems in a third-party service we use should be reported to that provider.

Please:

  • give us reasonable time to fix an issue before you disclose it;
  • only use accounts and data that are yours, and stop and tell us if you come across anyone else's personal data;
  • don't change or delete data, degrade the service (for example with denial-of-service or high-volume automated testing), or send messages to our users;
  • don't use social engineering, phishing, or physical attacks.

If you act in good faith and follow these guidelines, we will not pursue legal action against you for your research, and we will treat your testing as authorized.

How we protect data

  • Encryption. Traffic to CleverX is encrypted with TLS. Files, including recordings, are stored in Amazon S3 with server-side encryption, and public access to them is blocked. Our database runs on MongoDB Atlas, which encrypts stored data.
  • Hosting. CleverX runs on Amazon Web Services in the United States.
  • Access. Access to production systems is limited to authorized personnel. In a team workspace, roles (Owner, Admin, Researcher, Observer) control who can see and change each study.
  • Participant privacy. Researchers see participants' real names only where the study design allows it, and pseudonyms otherwise.
  • AI tools. AI tools sign in through OAuth with short-lived access tokens, see only what the connecting researcher can see in one workspace, and never receive participants' contact details. Our MCP server sits behind a web application firewall with rate limits. Details are in Section 15 of our Privacy Policy.
  • Fraud prevention. Device checks help keep fake and duplicate participants out of studies.
  • Vendors. The providers that process data for us are listed on our Subprocessor List.
  • Incidents. If a personal data breach affects study data, we notify the affected customers within 72 hours of becoming aware of it, as our Data Processing Addendum sets out.

Contact