Security & data

Security FAQ layout follows docs.x.ai/developers/faq/security, adapted to Clavue membership and api.clavue.com. Legal text in Privacy / Terms remains authoritative.

Does Clavue train on API / Chat requests?

By default, product improvement settings may allow limited use of consumer Chat data where disclosed in Privacy and in-product controls. Treat API keys and production prompts as sensitive. Enterprise or stricter retention options, if offered, are documented in Account / legal pages when available.

Do not send secrets (passwords, private keys, customer PII) in prompts unless you accept the residual risk.

What is retained?

Membership account data, order records, and usage meters are retained for billing and abuse prevention. Chat history may be stored for product functionality (multi-turn). Local project files stay on your machine unless you run tools that upload or send them.

How do I securely manage API keys?

Treat keys like passwords — never commit to git or share in chat
Store in environment variables or a secret manager
One key per environment / teammate; rotate if leaked
Disable or delete compromised keys in Account → API keys immediately

imux Unix socket access

Local socket controls the running IDE. Prefer “icc processes only” access mode on shared Macs. Non-focus automation must not activate windows. See Socket API docs.

Compliance (GDPR / SOC / HIPAA)

Public compliance certifications vary by product stage. Contact support for current status and enterprise agreements. Do not assume HIPAA BAA unless explicitly contracted.