Security
A feature platform you can inspect and operate.
Security review of infrastructure software starts with boundaries: where code runs, where data lives, and which systems your organization operates. This page states ClearFeature's boundaries plainly.
Deployment boundary
ClearFeature is self-hosted software. Every platform service — the HTTP API, the online, batch, and propagation workers, the compute core — runs in infrastructure you provision and control. There is no ClearFeature-operated service in the execution path, and no requirement to send data outside your environment.
Data storage boundary
The platform stores data only in backends you deploy and govern:
raw reports
MinIO / S3-compatible
history + metadata
PostgreSQL
latest values
Valkey
events
Kafka / Redpanda-compatible
Access control, encryption at rest, network segmentation, and backups for these systems follow your organization’s existing standards for the same components — ClearFeature does not replace them with proprietary equivalents.
Feature code and runtime model
Feature logic ships as a versioned Feature Project — a Python package your team writes, reviews, and tests. The runtime executes registry-declared UDFs from that project; it does not fetch or execute code from outside your deployment. Version pointers govern which feature artifact is live, with promotion and rollback as explicit operations.
Service boundaries
The architecture is a set of single-purpose services around one compute core, talking to storage backends you operate. That shape keeps the audit surface small: each service has one job, and the data flow between them is documented in the repository rather than inferred from a black box.
Inspectability as a security property
The entire execution engine is open source under Apache-2.0. Your security team can read how requests are handled, how source data is stored, and how feature values are computed — and can pin, patch, or fork the code under your own controls. Vulnerability reporting follows the repository's SECURITY.md.
What we do not claim
ClearFeature Labs does not currently hold formal certifications such as SOC 2 or ISO 27001, and this page makes no regulatory compliance claims on your behalf. Because deployment is self-hosted, your features run inside your existing controls — compliance posture is inherited from your environment and validated by your own assessments, with open code available to whoever performs them.
Security questions
If your security or infrastructure team is reviewing ClearFeature and needs specifics beyond the repository documentation, ask us directly — precise questions get precise answers.
Reviewing ClearFeature for adoption?
We are glad to walk your security and platform teams through the architecture.