# Clavitor LLC

> Clavitor LLC builds AI-native products for a world where software acts on our behalf: a credential vault for AI agents (Clavitor), an encrypted database engine (VaultDB), multi-model security audits (Securitor), an AI front desk (Callitor) and a private health dossier for your own AI (inomi). One idea across all five: AI that works for you, and answers to you.

This is the corporate site. Each product has its own site, customers and terms; follow the links below for product detail.

## Products

- [Clavitor](https://clavitor.ai/): The credential vault built for AI agents — and against them. Encrypted to your hardware, scoped per agent, auditable by event. Per-field AES-256-GCM, WebAuthn PRF hardware-derived keys, tamper-evident hash-chained audit log, 24 regions on six continents. Machine-readable summary: https://clavitor.ai/llms.txt
- [VaultDB](https://vaultdb.ch/): An encrypted database engine in Rust. Every record sealed before it touches the file, access-controlled down to a single node, chained into an audit log anyone can verify without a key, searchable by prefix without being decrypted. FIPS 140-3 validated module at rest (AWS-LC FIPS 3.1.0, CMVP #5314 static, pinned exactly; our servers are not among the certificate's tested environments). Crypto-shred erasure. Governed by Swiss law, venue Zürich.
- [Securitor](https://securitor.ai/): Independent security audits. Source code is read in parallel by a panel of models from all the leading AI labs, blind to one another, then adjudicated by an independent scorer into one deterministic, SHA-256-sealed, signed report.
- [Callitor](https://callitor.ai/): A voice-and-message front desk ("Stella") with a real scheduling engine underneath, for clinics, salons, studios and practices across 31 industries. Answers, books, reminds and back-fills; never double-books. Says she is an assistant if asked.
- [inomi](https://inomi.health/): Your health data — labs, scans, genome, symptoms — organized in one private dossier and ready for your own AI. Single-tenant hardware, never used for model training, shared with no one.

## Trust and compliance position

- SOC 2: self-assessed against the Trust Services Criteria; independent attestation to follow.
- ISO/IEC 27001: aligned, self-assessed. Every infrastructure subprocessor holds ISO 27001 or SOC 2.
- HIPAA: technical safeguards (45 CFR §164.312) mapped. There is no HIPAA certificate; business-associate terms on request.
- GDPR and Swiss FADP: Data Processing Agreement applies automatically to paid Clavitor subscriptions; subprocessors published (30 days' notice for Clavitor).
- FIPS 140-3: VaultDB 2.0.0 links a FIPS 140-3 validated module by default (AWS-LC FIPS 3.1.0, CMVP #5314 static), and so do the Clavitor vault and gate; built from the certified source and run in FIPS mode; the certificate's tested environments are Amazon Linux 2023 on AWS Graviton4 and Intel Xeon Platinum 8375C, and our servers are not among them. The boundary is data at rest.
- PCI DSS: out of scope by design — billing runs through Paddle as Merchant of Record.
- Appliance: organisations that need a certified boundary today can run the Clavitor vault on their own hardware, inside their own SOC 2 / ISO 27001 / HIPAA scope.
- Customer data is never used to train models.

## Infrastructure

- 24 vault regions on six continents; two independent control planes (Amsterdam, Osaka) that share no provider, owner, country or network.
- Live status: https://clavitor.ai/status
- Resilience engineering: https://clavitor.ai/resilience

## Security

- Report vulnerabilities: security@clavitor.ai (PGP: https://clavitor.ai/.well-known/pgp-key.txt)
- Disclosure policy and safe harbor: https://clavitor.ai/security/disclosure
- Per-product channels: https://clavitor.com/security/
- security.txt: https://clavitor.com/.well-known/security.txt

## Company

- Legal name: Clavitor LLC, a Florida limited liability company (document L26000186565)
- Principal office: 851 Brightwaters Blvd NE, St Petersburg, FL 33704, USA
- Legal and privacy: legal@clavitor.ai
- Enterprise and appliance: https://clavitor.ai/en/contact-sales

## Optional

- [Clavitor terms](https://clavitor.ai/en/terms)
- [Clavitor privacy](https://clavitor.ai/en/privacy)
- [Clavitor DPA](https://clavitor.ai/en/dpa)
- [Clavitor subprocessors](https://clavitor.ai/en/subprocessors)
- [VaultDB licensing](https://vaultdb.ch/licensing/)
- [Securitor method](https://securitor.ai/method)
- [inomi DPA](https://inomi.health/legal/dpa)