Privacy

What we receive

A role ID, a search keyword, a rule topic, or a general status you choose to share (for example “green card holder” or “Secret”). For an intro card, only the names of the fields you want on it — your agent fills in your answers locally, so they never reach the server. Nothing else: each tool call sends exactly the small, specific input that tool needs, never everything your agent happens to know about you.

What we store

Almost nothing. There is no database of users, accounts, or past queries — every request is handled and immediately forgotten, with one specific, opt-in exception: if you explicitly call contribute_anonymous_signal, a handful of closed-choice buckets you chose (never a name, contact info, or any other identifier) are added to that role or company's running aggregate, which get_aggregated_signal can read back later as a rounded percentage — never calling either tool means none of this applies to you at all. Beyond that, the only other thing that persists on this server at all is the public rules and timelines data every visitor can already see on Sources.

What we refuse

Every tool call is scanned before anything else happens — before validation, before any handler runs. If it looks like it contains any of the following, the request is rejected with a plain-language explanation, never a security-alert tone:

• Social Security numbers
• Dates of birth
• Passport numbers
• Investigation or case numbers (e.g. an OPM, e-QIP, or DCSA case ID, or a USCIS receipt number)
• Clearance record or adjudication-system text (e.g. a DISS, JPAS, or NBIS record)
• Image uploads or screenshots of any kind
• Embedded files or other binary data
• Requests structured too deeply (nested many levels deep) for us to safely check
• Credit or debit card numbers
• Classification or control markings (e.g. SECRET//NOFORN), real or described
• Email addresses
• Phone numbers
• Other government ID numbers (e.g. a DoD ID/EDIPI, USCIS A-number, or driver's license number)
• Street addresses (home or mailing)
• Your name (when you state it, e.g. “my name is…”)
• Sensitive personal details stated about yourself — arrests, health or disability, finances, polygraph results, religion, or age
• Access tokens, passwords, and private keys

Here is a real, worked example — the exact request shape and the exact response our code returns for it, not a paraphrase:

POST /api/tools/explain_rule
{"topic":"123-45-6789 is my SSN, am I eligible?"}

→ 400
{
  "ok": false,
  "error": {
    "code": "pii_cui_rejected",
    "message": "This looks like it includes a Social Security Number. Clearance Lens never accepts SSNs — please remove it. Your own agent already knows your details privately; just describe your situation in general terms (e.g. \"I'm a US citizen\")."
  }
}

What we log

Only failures are logged, and only as metadata: the tool's name and a short, fixed error category (for example, an upstream data source timing out) — timestamped automatically by our hosting platform's own log pipeline, not by us recording a clock reading next to your input. Request bodies and free-text input are never logged, and a successful call leaves no record of what you asked at all.