Security measures
Last updated: 23 September 2026
This page describes the technical measures Klarte uses for Klarte.no. It is part of the data processing agreement (Article 32) and the terms of use. It is not a promise of uninterrupted service.
1. Encryption in transit (HTTPS/TLS)
In production the site is served over HTTPS/TLS. Requests that arrive as plain HTTP are redirected to HTTPS. Local development on localhost is excluded from the redirect.
Sign-in session cookies are sent only over HTTPS when the site itself is running on HTTPS.
2. Encryption at rest and backups
Klarte does not store a readable copy of your password. Passwords are stored as hashes. Optional two-factor secrets are stored encrypted.
A daily backup job, when the production cron is installed, dumps the database, compresses it, and encrypts the file with AES-256 before it is stored. The key is kept outside the web root. If encryption is unavailable, the job does not write a plaintext dump. Encrypted backups older than 30 days are deleted automatically. The copies are stored on the server. That job does not upload them to a separate external machine.
The running database is protected by access control on the server. Klarte does not claim that every column in the running database is encrypted on its own.
3. Access
Access to operations and the database is limited to what is needed to run the Service. Security events, such as failed sign-in, are logged. Sub-processors (hosting, email, SMS, payments) are listed on sub-processors.
4. Right to erasure
When a booker asks to be forgotten, the business can delete or anonymise that person’s data from Dashboard → Settings → Legal → Help a customer, or the booker can use the privacy link in the email. See the data-request guide.
5. What this does not promise
The Service is provided “as is”. Klarte does not guarantee 100% uptime. Downtime and system errors can happen. Klarte does not cover a business’s lost revenue or lost customers as a result of downtime or system errors. The maximum compensation is set out in the terms of use, sections 8 and 9.