Data protection and security when using the API

CLUP.life is built for 100 % GDPR compliance, encryption of personal data and scalability. The interfaces weaken none of these.

What the platform ensures#

• Same rights, no special path: every request runs through the same services and permission checks as in the app (roles, visibility levels, children’s rights, “not visible = 404”).
• Closed by default (fail-closed): a key reaches only routes that are explicitly released for keys. Account, sessions, roles, finance, family/children, platform administration and key management never are.
• Children’s data is excluded. Child and youth accounts cannot create keys; children’s data and family links are not reachable with keys. Guardians act for children only in the app.
• No contact data: email addresses and phone numbers are stored encrypted and are never part of API responses. The member list contains display name and role, as far as the person’s role shows it.
• Keys only as checksum (SHA-256 over 256 bits of randomness); name, webhook address and signing secret encrypted. No keys in logs, audit entries or error messages.
• Logging: creating, renewing, revoking and every write call appear in the organization’s audit trail (without keys and names). Member exports are logged.
• Webhooks carry no personal data (type and identifier only), are signed and protected against SSRF.
• Counters without content: usage counters per day (calls, rejected calls) are kept for 30 days; neither content nor IP addresses are counted.

What your organization has to consider#

• Minimal rights: give every program its own key with exactly the required scopes and a short validity. One key for “everything” is a risk.
• Data processing: CLUP.life processes your organization’s data on your behalf (data processing agreement concluded in the app). As soon as you pass data on through the API to another tool (Zapier, Make, Google Sheets, a website agency), you are responsible for that transfer: you need a legal basis and, where applicable, your own contract with the provider.
• Names of third parties: pass member names on only if the transfer is permitted. The webhook path (“notify first, then fetch with a key”) helps to transfer only what is necessary.
• Departing leadership: the new leadership revokes predecessors’ keys and creates its own.
• Deletion: when an account is deleted its keys are removed. Member exports you downloaded are your responsibility afterwards.

Prompt injection with AI assistants#

Content from CLUP.life (titles, posts, names) is data, not instructions. The MCP server tells the assistant so explicitly; still: use write tools only with an organization key and set them to “ask every time” in the client. See MCP server.

Found a vulnerability?#

Please report it through support and not publicly. We acknowledge receipt and fix vulnerabilities as a priority.