Clarity Security Professional Services Accounts and Security Controls

Account Descriptions

The Clarity Platform provides three user-accounts intended for Clarity Professional Services staff and senior engineers. These accounts are:

Clarity Admin

Clarity Maintenance

Clarity Support

The Clarity Admin account has full admin permissions on the platform. This account is primarily intended for members of the professional services team to assist with initial onboarding, configuration, and to debug issues that may arise during the POC/onboarding process. After this process is complete, the account may be deactivated at the discretion of the client.

The Clarity Maintenance account has admin permissions, as well as end-user permissions initially and is meant to be used when an issue arises after “steady state” is reached, and additional help is needed either from the professional services team or a senior Clarity engineer. This account should have the “Admin” Clarity Entitlement removed at the discretion of the client once the issue has been resolved, leaving only the end-user permission on this account.

The Clarity Support account has read-only access to the deployment and is intended to be used by Clarity support staff to assist in day-to-day debugging of issues such as checking reports, reviewing configurations, and reviewing Access Review templates.

Account Access

Each of these accounts’ access is managed within the Clarity platform, and the ability to login via this accounts can be removed at the discretion of the client. The login information for these accounts is stored securely in the Clarity Security internal password vault and shared only with members of the Professional Services team and select senior staff (CTO and VP of engineering, as well as CEO).

Account Security

The user data, including passwords, for these accounts are stored in the Clarity database. Each deployment has a single-tenant database, which shares no resources with other Clarity deployments. Additionally, each client typically has their own database cluster which is not shared with any other clients. Clients who have multiple clarity deployments (dev and production for instance) may have two or more databases on the same cluster which share compute resources, but each database and its user store are separate.

The Clarity platform salts and hashes passwords at rest, according to best practices, and login information is never stored or transmitted in plain-text.