Security · last updated 14 October 2026
What we do, and what we do not have.
Where it runs
klapp runs on Microsoft Azure in the Norway East region. The server, the logs and the files we store, such as saved events and rounds, run in Norway East. The one exception is the AI provider, described under “The AI” below.
Secrets, traffic and sign-in
- Secrets are kept in Azure Key Vault and reach the server as references. They are not in the code repository.
- HTTPS. All traffic to the site and the game goes over HTTPS. The storage account takes HTTPS only, with TLS 1.2, and has no public access.
- Sign-in for hosts is with Microsoft or Google, through OpenID Connect, on their own sign-in pages. klapp has no passwords and no account database. A host's name and e-mail address are kept in a signed cookie in the host's own browser for 14 days or until sign-out.
- Cards are typed on Stripe's fields, never on klapp. We never see the card number.
Participants
Players have no account and are asked for no name and no e-mail address. They get a nickname, assigned or chosen by themselves. No nickname and no answer from a player is kept after the game. While it runs, they and the scores are held in the server's memory and in one file in our storage so that the game can go on after a restart, and both are deleted when the game ends.
An event keeps only the counts per poll option and the top ten of each quiz, with nickname and points, in memory until the event ends, and at most twelve hours. Who answered what is never kept. The full account is on privacy.
People who register for an event are described on privacy; the room is as before.
The AI
Anthropic writes the quiz questions and the answer suggestions in a Q&A. The processing happens in the United States, outside Norway East. In a Q&A it receives the pages of the slides and documents the host kept and each question from the room, never who asked. Slides, documents and questions can contain personal data, because the material is whatever the host uploads and the audience types.
Anthropic's commercial terms say it may not train models on customer content. The transfer rests on the EU standard contractual clauses in its data processing addendum; Anthropic was not on the EU–U.S. Data Privacy Framework list when we checked on 4 October 2026. It says it deletes what we send within 30 days. The details are on subprocessors.
We intend to move the AI to an EU region in Azure when Claude is available there. That is a decision, not a date: we have none.
Who else, and the processing terms
The companies that receive anything are listed on subprocessors. An organisation that runs a Q&A for its own purposes is the controller of the material, and the data processing terms apply.
Certification
klapp has no security certification and no audit report today. A SOC 2 audit is started when the first business customer asks for it.
Report a vulnerability
Write to hello@playklapp.com. It is the only address klapp has, and it is forwarded by our domain registrar, Porkbun, to a Google Gmail inbox, so both see what you write. Say what you found and how to reproduce it. Please do not read, change or keep other people's data, and do not run load against the live service.
The same contact is in security.txt.