Trust is not a feature.
It is the foundation.
Clerra is built to hold your firm's tax documents and financial records. Every layer is designed around isolation, accountability and Canadian data residency.
In Canada
Where your data lives
Records and documents in Montréal, with encrypted backups in Montréal and Calgary.
Every upload
Scanned for malware
Whatever its size, on our own scanner — and blocked until it passes.
Every week
Backups test-restored
Nightly encrypted backups, restored and checked weekly so we know they work.
Walled off
Firm by firm
Row-level security inside the database, two-factor sign-in and expiring links.
Checked on the way in. Protected all the way through.
Tax slips, IDs, financial statements: here's what happens to a file from the moment a client uploads it. Malware scanning is included for every firm.
Uploaded
Type and size are checked, and the file goes into private storage kept apart for your firm and the client.
Scanned for malware
An automatic scan runs on our own infrastructure, so your clients' files never go to a third-party scanner. A file that hasn't passed its check can't be opened, and if the check can't finish, it stays blocked and is retried.
Flagged? Quarantined
Anything the scan flags is blocked from everyone and set aside, and it's marked clearly so an upload never silently vanishes.
Shared safely
Downloads use expiring links, created only after the database confirms the person may see that exact file.
Backed up every night
Each file is copied, encrypted, to two Canadian cities, Montréal and Calgary, and we test-restore from those backups every week.
A backup you can count on, and prove.
Included for every firm, and there's nothing to set up.
Nightly
Every file and your practice records are copied automatically.
2 cities
Montréal and Calgary, both in Canada. Each backup is protected from deletion for 30 days in both.
90 days
Deleted or replaced files stay recoverable for 90 days. Daily records snapshots are kept 90 days too.
Weekly
Every week we restore from the backups, decrypting the latest records and a sample of files and checking they match, so we know they work.
Keeping documents in your firm's own OneDrive, SharePoint or Google Drive instead of the Clerra Vault? Those files are protected by Microsoft's or Google's backups, not Clerra's. Your practice records are still backed up every night.
No fine print about what's included.
Automatic, for every firm
- Malware scan on every upload, whatever its size
- Encryption in transit and at rest
- Private storage, isolated per firm and per client
- Expiring, permission-checked download links
- Nightly encrypted backups in two Canadian cities
- Activity log of document access and changes
- CAPTCHA and rate limits on sign-in
Yours to switch on and set
- Authenticator-app two-factor sign-in (each person turns it on)
- Requiring two-factor sign-in for your Client Center (a firm setting)
- Who on your team can see, share and delete documents (roles and permissions)
- Which files each client can see in their portal
Every layer. One standard.
Canadian data residency, by default
Your client records and documents are stored in Canadian data centres (Montréal region), and backups are kept in two Canadian cities, Montréal and Calgary. AI-assisted features — such as email summaries and the in-app support assistant — are processed in the United States. See our privacy policy for the categories of providers we use.
Firms are isolated at the database
Every row of data is locked to your firm by row-level security enforced inside the database itself — not just in application code. No bug, no misconfigured screen, no clever request can show one firm another firm's data.
Clients see only what's theirs
The Client Center is a separate trust zone. A client sees their own document checklist and the files you've chosen to share — never your notes, your other clients, your team's workload or anything internal. We test these boundaries automatically.
Documents are never publicly addressable
Files live in private storage, scoped per firm and per client. Downloads happen through expiring signed links generated only after the database confirms the person is allowed to see that exact file. Uploads are validated by type and size.
Two-factor authentication, for staff and clients
Anyone — your team or your clients — can protect their account with an authenticator app, and once it's on, a password alone is never enough to get in. Firms can also require it for everyone who signs in to their client portal.
Everything sensitive is on the record
Document access, uploads, deletions, invitations, permission changes — recorded in an activity log your firm's admins can review. When a client asks who touched their file, you have an answer.
Encrypted everywhere
Data is encrypted in transit (TLS) and at rest. Payment details never touch our servers — billing runs entirely through a dedicated third-party payment processor.
Least privilege, by default
Staff roles separate day-to-day work from administration. Billing, team management, client deletion and the audit trail are admin-only. Public sign-in pages are protected by CAPTCHA and rate limits.
Ready for IT. Ready to scale.
The controls a growing firm needs to standardize on Clerra. Talk to us about what your firm needs.
Single sign-on (SAML)
Sign in through your firm's identity provider. In development for larger firms — ask us about timing.
Service commitments in writing
Firms that need specific uptime or support commitments can have them set out in an Order Form.
Guided onboarding & migration
We bring in your client list from QuickBooks, Sage or a spreadsheet and get your whole team live.
Granular roles & audit trail
Role-based access across offices, with a complete firm-wide activity log for every action.
Security is the foundation, not a feature.
Every upload scanned
Nightly encrypted backups
Data stored in Canada
Full activity audit trail
Have a security question we haven't answered?
Write to security@commongoodlabs.ca — we answer these personally.