{ "record": "CLEATUS Secure Configuration Guide (GovCloud offering)", "version": "1.5.0", "asOf": "2026-10-18", "offering": "CLEATUS GovCloud offering (AUTH_PROVIDER=better-auth, CLEATUS_MODE=govcloud)", "roles": { "top-level-admin": "organization Owner: the account that controls enterprise access to the whole tenant (billing, every user and team, every entity). The Owner is a Customer Admin.", "privileged": "organization Admin: manages users and teams, entity settings, and the organization Security settings, but not billing. An Admin is a Customer Admin.", "user": "Member and Member (restricted): everyday users; restricted members cannot move pursuits or manage users" }, "maintenance": { "maintainedBy": "Engineering", "approvedBy": "Change Control Board", "process": "Engineering updates this guide in the same pull request as any change to a security-related setting or its default. The Change Control Board approves the pull request before merge. Each guide version is recorded in releaseHistory. Roles are those of the CLEATUS system security plan." }, "secureDefaults": { "appliedAt": "tenant provisioning", "statement": "Every new organization starts with the default of each setting in this guide. Access defaults deny until someone grants access: every new user joins as Member, and no API key, connector authorization, workflow webhook, or integration exists until a user creates one. A new API key is read-only and expires after one year. Session limits start at the FedRAMP limits in SCG-03, and a Customer Admin can only shorten them. Only a Customer Admin creates or revokes an API key or changes the organization Security settings.", "fields": "default is the secure default applied at provisioning. recommended describes how to operate the setting after provisioning.", "versioning": "The defaults are part of the product code. A change to a default ships only with a new guide version and a releaseHistory entry." }, "automation": { "machineReadableGuide": "https://trust.cleat.ai/secure-configuration-guide.json", "compareWithGuide": "Dashboard, Settings, Security, Compare with the Secure Configuration Guide (Owner): current settings next to the recommendations in this guide, with a result for each, and Download JSON for the full export.", "organizationExportApi": "organizations.securitySettings: the tRPC procedure the dashboard calls at https://api.cloud.cleatgov.us/trpc/, authenticated with the Owner session. Returns JSON.", "entityExportApi": "GET https://api.cloud.cleatgov.us/api/v1/security/settings with the entity X-Api-Key of an Owner or Admin assigned to the entity. Returns the entity settings and their comparison with this guide in JSON.", "completeOrganizationExportApi": "GET https://api.cloud.cleatgov.us/api/v1/security/organization-settings with an entity X-Api-Key held by the organization Owner. Returns one machine-readable row for every SCG-01 through SCG-15 setting. Manual-review rows remain explicit.", "changeApi": "organizationSecurity.setSessionIdleMinutes, organizationSecurity.revokeSession, organizationSecurity.revokeConnector, apiKeys.create, and apiKeys.revoke: the tRPC procedures the dashboard calls, authenticated with the Customer Admin session. Each organizationSecurity change writes an audit log entry in the same transaction as the change.", "restChangeApi": "PATCH https://api.cloud.cleatgov.us/api/v1/security/settings with a write-scoped X-Api-Key. The operation is setSessionIdleMinutes, revokeSession, or revokeConnector. The route reuses the audited Customer Admin procedures." }, "settings": [ { "id": "SCG-01", "scope": "top-level-admin", "lifecycle": ["access"], "setting": "Owner account identity", "default": "the person who creates the organization becomes Owner; one Owner", "recommended": "a named individual with a work email on the agency domain; no shared or role mailbox; a second Admin designated so the Owner is never the only administrator", "implication": "the Owner can add or remove every user, change roles, and delete the organization; a lost or shared Owner account is a total-tenant risk", "howToSet": "Contact CLEATUS support for GovCloud invitations and provisioning. Self-service flows that depend on the commercial identity provider are unavailable in GovCloud. Existing role settings appear under Users and Teams.", "api": false }, { "id": "SCG-02", "scope": "top-level-admin", "lifecycle": ["access"], "setting": "Owner and privileged account authentication", "default": "GovCloud requires a device-verified passkey or security key and a verified email before application access. New and reset passwords require at least 14 characters.", "recommended": "Use a named account, a unique password-manager passphrase, and two passkeys or security keys. Keep each recovery device secure.", "implication": "Password, authenticator-code, and recovery-code sessions cannot access application data. Code verification can enroll the first passkey only. Existing passkeys require passkey verification to add another.", "howToSet": "Open Secure your account after signing in. Verify your email and authenticator during initial enrollment, then register and verify a passkey. Add a second passkey before retiring a device.", "api": false }, { "id": "SCG-03", "scope": "top-level-admin", "lifecycle": ["operate"], "setting": "Owner session", "default": "GovCloud ends a session after 15 minutes of inactivity. For Owner and Admin users, the limit is 10 minutes. Every session also ends 12 hours after sign-in. Activity refreshes the session each minute.", "recommended": "Keep the defaults, or shorten the inactivity window for the whole organization (SCG-15). Sign out on shared devices and do not share the browser profile. Password resets revoke all sessions. Password changes revoke other sessions.", "implication": "a captured session cookie works only until the inactivity window or the 12-hour limit ends it, or the session is revoked", "howToSet": "Sign out from the account menu. Use password reset to revoke all sessions; a password change revokes other sessions. Dashboard, Settings, Security lists and ends sessions (SCG-15).", "api": false }, { "id": "SCG-04", "scope": "top-level-admin", "lifecycle": ["configure", "operate"], "setting": "User roles and invitations", "default": "a new user joins as Member", "recommended": "invite only people with a need; keep at most two Admins; use Member (restricted) for read-mostly users; review the user list quarterly and remove leavers the day they leave", "implication": "Admins can invite anyone and change roles; every Member can read the entity data they are assigned to", "howToSet": "Contact CLEATUS support for GovCloud invitations and provisioning. Self-service flows that depend on the commercial identity provider are unavailable in GovCloud. Existing role settings appear under Users and Teams.", "api": false }, { "id": "SCG-05", "scope": "top-level-admin", "lifecycle": ["configure"], "setting": "Billing and plan changes", "default": "Owner only", "recommended": "keep Owner only", "implication": "plan changes alter which features (workflows, API) are enabled for the tenant", "howToSet": "Dashboard, Settings, Billing (Owner only)", "api": false }, { "id": "SCG-06", "scope": "top-level-admin", "lifecycle": ["decommission"], "setting": "Organization decommissioning", "default": "no self-service deletion. On a verified written request from the Owner, CLEATUS deletes the organization's customer data from the production systems within 30 days, under the CLEATUS Data Management Policy, and records the request and its fulfilment. Encrypted backups that hold the data expire on their retention schedule.", "recommended": "remove all users, revoke every API key and connector authorization, then have the Owner request deletion in writing; keep the written confirmation", "implication": "data persists until the deletion procedure runs; open keys and connector authorizations keep working after users leave; financial records are retained for seven years as US tax law requires", "howToSet": "1. Users and Teams: remove every user except the Owner. 2. Entity Settings, API keys: revoke every key. Settings, Security: revoke every connector authorization. 3. The Owner emails security@cleat.ai from the Owner account address and names the organization. 4. CLEATUS confirms the request with the Owner, deletes the data within 30 days, and sends a written confirmation that lists any record retained by law.", "api": false }, { "id": "SCG-13", "scope": "top-level-admin", "lifecycle": ["decommission"], "setting": "Owner account retirement", "default": "no self-service ownership transfer; the Owner role stays with the account until CLEATUS support moves it", "recommended": "before the Owner leaves or changes role, name a successor, ask CLEATUS support in writing at security@cleat.ai to move the Owner role to that person, confirm that the successor can sign in as Owner, then remove the former Owner the same day", "implication": "a person who left but still holds the Owner role keeps full control of every user, role, and entity until the account is removed", "howToSet": "Written request to security@cleat.ai; Users and Teams (remove the former Owner)", "api": false, "gap": "SCG-G6: no self-service ownership transfer; the Owner role moves only through a CLEATUS support request" }, { "id": "SCG-14", "scope": "top-level-admin", "lifecycle": ["configure", "operate"], "setting": "User browsers use encrypted communications", "default": "CLEATUS accepts only TLS 1.2 and TLS 1.3, and port 80 redirects to HTTPS. CLEATUS does not manage the browsers of customer users.", "recommended": "The Customer Admin is responsible for configuring user browsers to use encrypted communications. Use a supported browser with TLS 1.2 or later enabled and older protocols disabled. Open CLEATUS only over HTTPS. Do not let users bypass a certificate warning; treat a warning as a security incident and report it to security@cleat.ai.", "implication": "a browser that allows older TLS versions or lets a user click through a certificate warning can expose credentials, session cookies, and customer data to interception", "howToSet": "Customer endpoint management (for example group policy or mobile device management): enforce TLS 1.2 or later, HTTPS only mode, and no certificate warning override in each managed browser", "api": false }, { "id": "SCG-07", "scope": "privileged", "setting": "API keys (entity level, REST API)", "default": "none; a key is created on demand. A new key is read-only and expires one year after creation; read and write scope is an explicit choice at creation. The secret is shown once and only its hash is stored; prefix ck_live_", "recommended": "one key per integration, named for it; read-only unless the integration writes; revoke on rotation or when the integration is retired; check the last-used date monthly; replace any key that shows no expiry date", "implication": "a key acts on its entity with its scope until it expires or is revoked; a leaked key must be revoked immediately", "howToSet": "Dashboard, entity Settings, API keys tab: Create new key (name and scope), Revoke. Owner or Admin only.", "api": true, "apiNote": "keys are created and revoked through the same tRPC procedures the dashboard calls (apiKeys.create, apiKeys.revoke); the REST API is authenticated with the key" }, { "id": "SCG-08", "scope": "privileged", "setting": "MCP connector authorizations (Claude, ChatGPT, other MCP clients)", "default": "none until a user connects; OAuth 2.1 with PKCE; scopes read and write; v1 tokens receive full access to the chosen entity; refresh rotation with replay detection revokes the token family", "recommended": "connect only from accounts the tenant controls; choose the narrowest entity; disconnect from the client when no longer needed; review the connector authorizations monthly and revoke any that are not in use", "implication": "a connected assistant acts with the connecting user's entity access; rate limits 100 reads and 30 writes per minute per token", "howToSet": "Client side: claude.ai directory connector or the MCP client settings. Server side: /oauth/authorize entity picker. Dashboard, Settings, Security, Connector authorizations: Revoke (Owner or Admin).", "api": true, "apiNote": "OAuth 2.1 endpoints /oauth/authorize and /oauth/token; discovery at /.well-known/oauth-authorization-server; organizationSecurity.revokeConnector revokes an authorization" }, { "id": "SCG-15", "scope": "privileged", "setting": "Organization session inactivity window and member sessions", "default": "members are signed out after 15 idle minutes; Owner and Admin sessions end after 10; every session ends 12 hours after sign-in", "recommended": "choose 10 or 5 minutes where users work on shared or unattended devices; review the active sessions after a role change or a suspected compromise and end any session you do not recognize", "implication": "a shorter window limits how long an unattended signed-in browser stays usable; ending a session signs that browser out on its next request, and the user must sign in again with a passkey", "howToSet": "Dashboard, Settings, Security (Owner or Admin): Session inactivity (5, 10, or 15 minutes) and Active sessions (End session). The window applies to every member; a user in several organizations gets the shortest window. Ending a session signs that browser out of every organization the user belongs to.", "api": true, "apiNote": "organizationSecurity.get, organizationSecurity.setSessionIdleMinutes, and organizationSecurity.revokeSession; each change writes an audit log entry" }, { "id": "SCG-09", "scope": "privileged", "setting": "Workflow webhooks (outbound and inbound)", "default": "none; an outbound Webhook node POSTs to an HTTPS URL the builder enters with the headers the builder sets; an inbound Webhook trigger starts a workflow from an external POST", "recommended": "HTTPS endpoints only; an authentication header on every outbound node; treat inbound trigger URLs as secrets and rotate them by recreating the trigger", "implication": "outbound nodes send opportunity and pursuit data to the destination; inbound triggers let anyone with the URL start a workflow", "howToSet": "Dashboard, Workflows: Webhook node settings", "api": false }, { "id": "SCG-10", "scope": "privileged", "setting": "Integrations (PIEE and other entity integrations)", "default": "none", "recommended": "connect with a dedicated service identity; record who connected it and when; disconnect on personnel change", "implication": "stored integration credentials act on the external system on the tenant's behalf", "howToSet": "Dashboard, entity Settings, Integrations", "api": false }, { "id": "SCG-11", "scope": "user", "setting": "Notifications and email", "default": "in-app and email notifications on", "recommended": "keep email notifications on for security-relevant events (invitations, role changes)", "implication": "email is the channel for verification and reset codes", "howToSet": "Dashboard, Settings, Notifications", "api": false }, { "id": "SCG-12", "scope": "user", "setting": "Team and pursuit sharing", "default": "a user sees the entities and teams they are assigned to", "recommended": "assign users to teams by need; use Member (restricted) for external collaborators", "implication": "team membership grants read and edit access to shared pursuits and documents", "howToSet": "Dashboard, Settings, Users and Teams", "api": false } ], "releaseHistory": [ { "version": "1.0.0", "date": "2026-09-06", "change": "first guide; written from the code and configuration of the GovCloud offering (Better Auth provider, roles, API keys, MCP OAuth, workflow webhooks)" }, { "version": "1.1.0", "date": "2026-09-08", "change": "Require device-verified passkeys for GovCloud application access. Align password length and session revocation with secure defaults. Deployment verification is pending." }, { "version": "1.2.0", "date": "2026-10-07", "change": "Tag each top-level administrative setting with the lifecycle phase it covers (access, configure, operate, decommission). Add SCG-13, Owner account retirement." }, { "version": "1.3.0", "date": "2026-10-16", "change": "Correct SCG-03 to the deployed GovCloud session limits (15 idle minutes, 10 for Owner and Admin, 12 hours maximum). Give every open gap an owner and a target date. Record the production verification of the passkey and session settings." }, { "version": "1.4.0", "date": "2026-10-16", "change": "Add SCG-14: the Customer Admin is responsible for configuring user browsers to use encrypted communications (TLS 1.2 or later, HTTPS only, no certificate warning bypass)." }, { "version": "1.5.0", "date": "2026-10-18", "change": "Add SCG-15: Customer Admins set the organization session inactivity window and end member sessions (closes SCG-G2). Add connector authorization review and revocation to SCG-08 (closes SCG-G5). Publish the customer data deletion request steps in SCG-06 (closes SCG-G3). Correct SCG-07 to the read-only, one-year default of entity API keys (closes SCG-G4). Add the maintenance, secure defaults, and automation sections. Name the Owner and Admin as Customer Admins." } ], "gaps": [ { "id": "SCG-G2", "gap": "no tenant control over session length or an admin view of active sessions", "status": "fixed-pending-release", "owner": "CLEATUS engineering (Change Control Board)", "targetDate": "2027-01-29", "resolution": "SCG-15 and SCG-08 describe the Customer Admin controls. They reach GovCloud production with the next release; the status changes to closed after production verification." }, { "id": "SCG-G3", "gap": "the customer data deletion procedure is a draft pending sign-off", "status": "closed", "owner": "CLEATUS engineering (Change Control Board)", "targetDate": "2026-11-13", "resolution": "SCG-06 publishes the deletion request steps under the CLEATUS Data Management Policy." }, { "id": "SCG-G4", "gap": "API keys have no scopes and no expiry date", "status": "closed", "owner": "CLEATUS engineering (Change Control Board)", "targetDate": "2027-01-29", "resolution": "Entity API keys carry a read or write scope and an expiry date in GovCloud production. SCG-07 states the read-only, one-year default." }, { "id": "SCG-G5", "gap": "no tenant-side page to list and revoke active MCP authorizations; granular scopes are on the roadmap", "status": "fixed-pending-release", "owner": "CLEATUS engineering (Change Control Board)", "targetDate": "2027-01-29", "resolution": "SCG-08 describes the Customer Admin review and revocation of connector authorizations. It reaches GovCloud production with the next release; the status changes to closed after production verification." }, { "id": "SCG-G6", "gap": "no self-service ownership transfer; the Owner role moves only through a CLEATUS support request", "status": "open", "owner": "CLEATUS engineering (Change Control Board)", "targetDate": "2027-03-31" } ], "publication": { "humanReadable": "https://trust.cleat.ai/secure-configuration-guide.md", "machineReadable": "https://trust.cleat.ai/secure-configuration-guide.json", "onRequest": "security@cleat.ai" }, "publicationReview": { "status": "pending-deployment", "verifiedAt": "2026-10-18", "note": "SCG-01 to SCG-14 match GovCloud production release v2026.10.17b-ksi-release. SCG-15 and the connector authorization review in SCG-08 reach GovCloud production with the next release, which release-notes.json records. The review is repeated after that release." } }