ClearPoint Trust Center
Welcome to the ClearPoint Strategy Trust Center. ClearPoint Strategy is the business name of Ascendant Strategy Management Group, LLC. It is a web-based SaaS platform for strategy planning, execution and performance reporting, and the world's first integrated strategy reporting and execution system. Established in 2008, ClearPoint helps organizations turn strategic goals into measurable results and align teams around key objectives.
Our platform centralizes planning, performance tracking, reporting, and project management, enabling better transparency and execution of strategy across departments for a diverse range of clients including healthcare networks, credit unions, regional banks, local governments, state agencies, and utilities.
This Trust Center serves as a comprehensive resource, offering a clear and accessible overview of ClearPoint Strategy's security and trust practices. ClearPoint is a fully remote company. Our mailing address is 399 Boylston Street, Suite 650, Boston, MA 02116. Security contact: our CTO and Chief Security Officer, [email protected], 866-568-0590.
- How does ClearPoint handle backups and disaster recovery?
- Is customer data used to train AI models?
- Where is customer data hosted?
- Does ClearPoint perform penetration testing?
- Does ClearPoint offer a data processing agreement?
Subprocessors
ClearPoint Trust Center Updates
Security updates
October 2026: security headlines and ClearPoint
Several widely reported vulnerabilities this fall are on the U.S. government's (CISA's) list of flaws being actively exploited. Here's where ClearPoint stands on the ones that touch software we use.
- WordPress (CVE-2026-87902). A critical WordPress flaw that attackers can exploit without signing in. Every public dashboard site we host runs a WordPress version that includes the fix, and all of them were updated to the latest release on October 29.
- PHP (CVE-2026-109618, CVE-2026-109619). Two flaws in PHP, the language WordPress runs on. All of our WordPress sites run a PHP version that contains both fixes.
- Windows, October "Patch Tuesday" (CVE-2026-96951). An actively exploited Windows flaw. Our Windows database servers have had Microsoft's October security update installed since October 24.
- Linux kernel (CVE-2026-46300). A flaw that lets a local user gain elevated privileges. Our Linux servers run kernels newer than Amazon's fix, and this month we rebuilt them on Amazon's latest server images.
- Atlassian (CVE-2026-21589). We use Atlassian's cloud service, which Atlassian has patched for all customers.
Not affected: we don't run Fortinet, Ivanti, Citrix, Palo Alto Networks or Cisco security appliances, or self-hosted SharePoint, in our hosting environment.
Questions? Contact [email protected].
Subprocessor list updated
Removed: Gravatar. ClearPoint no longer loads avatar images from Gravatar, and uploaded profile photos are unchanged.
Removed: ipstack (APILayer). IP geolocation for sign-in device labels now uses Cloudflare, an existing subprocessor. Our Data Processing Agreement, version 1.1, reflects the current list.
Removed: Pinecone. Search embeddings now live in ClearPoint's own database in Amazon Web Services, an existing subprocessor, and the Pinecone indexes were deleted on October 28, 2026.
Removed: Tavily. AI web search now uses OpenAI, an existing subprocessor.
We updated our subprocessor list on October 23, 2026.
- Added: Ping Identity, Stytch, Tavily, ipstack, Gravatar and Pinecone. These vendors already supported the service, and the list now names them.
- We will retire Pinecone and EverAfter by the end of 2026.
- Removed: Agency AI.
- Renamed: the list now shows Microsoft Azure as Microsoft.
- Clarified: PartnerHero support staff work in the United States and Honduras, and the list names the AWS regions we use.
We give 30 days' notice here before we add or replace a subprocessor. Subscribe to get these notices.