Security
Controls on every payment, and a record nobody can quietly change
Before a payment is sent
Verified businesses
Businesses are verified with Middesk against Secretary of State records and IRS TIN matching before they can send or receive payments.
Verified people
The owners and controllers of businesses that send payments complete identity verification.
Sanctions and fraud checks
Every payment is screened against U.S. sanctions lists and assessed for fraud risk. Payments that need a closer look are held for our compliance team, and nothing is sent until they decide.
Verified bank accounts
Bank accounts linked through Plaid are matched to the business that owns them. Accounts added by vendors are confirmed with two small deposits before they can be paid.
Approvals
You set which payments need approval and by how many people. The person who starts a payment can never approve it.
No double payments
Every payment request carries an idempotency key. Retrying after a timeout returns the original payment instead of sending a second one.
Your account
Two-factor sign-in, required
Every user signs in with a password and a code from an authenticator app. Sessions are held in secure, HTTP-only cookies.
Roles
Viewers, initiators, approvers, admins and owners each get only what their role needs. Admins see a log of sign-ins and role changes.
API keys and signed webhooks
API keys are shown once and stored hashed. Every webhook is signed so your systems can verify it came from us.
Infrastructure
Designed for AWS in the U.S.
The platform is built to run on AWS in a private network behind a web application firewall, with data encrypted in transit (TLS) and at rest with managed keys.
Tamper-evident ledger
Every payment event is written to a hash-chained ledger. Its checkpoints are signed with a managed key and built to be anchored in write-once storage, so any later edit is detectable.
Bank details stay with the specialists
Vendors enter account numbers directly into our payment provider's secure form; linked accounts connect through Plaid. We don't ask for bank passwords.
Found a security issue? Please tell us through the contact page and we'll respond promptly.
Clear Transfer is a financial technology company, not a bank, and is not FDIC-insured. Payments settle through regulated partner banks via our payment providers.