Security and compliance: Clikma's controls
For IT, information security, risk and legal teams: what controls Clikma has, how they relate to the most widely used reference frameworks and how an incident is handled.
- Single sign-on, second factor and IP allowlists
- Field-by-field change audit
- Encryption in transit and at rest
- Incident response with NIST SP 800-61
Updated 2026-10-24
How secure is the Clikma platform, and how do its controls relate to ISO 27001 and NIST?
Clikma protects access with single sign-on (SAML 2.0 or LDAP), a second factor, password policies, session control and IP allowlists per company; it records every change field by field; it encrypts data in transit and at rest; it hosts the production database in the Santiago region with a standby replica and daily backups; and it has an incident response team that works with the NIST SP 800-61 method.
This page relates those controls to the six functions of the NIST Cybersecurity Framework 2.0 (govern, identify, protect, detect, respond and recover) and to the four control themes in Annex A of ISO/IEC 27001:2022 (organizational, people, physical and technological).
It is a description intended to make your security assessment easier, not a certification statement. If your company's procurement process requires a specific certificate or audit report, ask for it during the evaluation and we will tell you what documentation is available.
- 6
- NIST CSF 2.0 functions covered by the controls described
- ≤ 30 min
- first response to a critical incident
- 14 days
- of point-in-time database recovery
- 99.5%
- guaranteed availability
Identity and access control
Each company decides how its people sign in, from where and with what permissions.
Single sign-on (SSO) with SAML 2.0 and LDAP
It is set up with the company's identity provider, so people log in with the credentials they already use.
Two-factor authentication (MFA)
A second factor with an authenticator app, turned on per company and per user.
Password policies per company
Complexity, history, expiration and lockout after failed attempts.
IP allowlist per company
Each company defines the addresses from which people can sign in or use the API.
Active session control
Shows where sessions are open and lets you force them to close.
Custom roles and permissions
Roles built from the base roles, on the principle of giving each one only what it needs.
Traceability and auditing
What happens on the platform is recorded: who changed what, when and, if they were viewing the platform as another person, why.
Field-by-field change audit
Records who changed each piece of data and, if an impersonation was in progress, who was impersonating.
Read-only user impersonation
To diagnose a problem without changing anything, with a reason, a start, an end and a visible notice.
Change history for each piece of content
Who changed what in each piece of content, with the previous value and the new one.
Bulk upload history
Status, errors and original file of each bulk upload.
Exportable compliance audit trail
History of each requirement and document, exportable for audits and regulatory inspections.
Data protection
Each company's data travels encrypted, is stored encrypted and is kept separate from other companies' data.
Encryption in transit
All traffic goes over HTTPS with TLS, and certificates are renewed automatically.
Encryption at rest
The database, backups and files are stored with the encryption at rest applied by the cloud provider.
Data hosted in Chile
The platform and its production database operate in the Santiago region.
Logical separation by company
Each user accesses only their company's data, according to their privileges.
Content does not train the AI
The AI assistant indexes the company's content to answer questions, without using it to train the model.
Rights of personal data subjects (Ley 21.719)
Requests for access, rectification, erasure and consent are handled through a defined procedure.
Secure development and change management
Every change follows the same path before it reaches production.
Separate environments
Development, demo, user acceptance testing and production, each with its own data.
Review of every change
Every change comes in through a merge request that is reviewed and approved before it reaches the production branch.
Static code analysis
Each service is analyzed to detect bugs and vulnerabilities before it is merged.
Accessibility checks on every update
Automated rules check the accessibility of every change; a change that does not pass is not merged.
Versioned infrastructure
The infrastructure configuration is declared in versioned repositories.
Continuity and recovery
The platform is designed so that the failure of a component does not stop the service, and so that data can be recovered if needed.
Service redundancy
Each production service runs with more than one replica on Kubernetes.
Database with a standby replica
A replica in another zone of the region takes over if the primary database fails.
Daily backup and point-in-time recovery
The database can be restored to any moment in the last 14 days.
Documented rebuild
A scripted procedure makes it possible to bring up the entire platform on a new cluster, and the cluster configuration is backed up every day.
Incident response
Clikma has an incident response team (IRT) made up of the PMO, general management, technology management and the development team, which works with the NIST SP 800-61 method: preparation, detection and analysis, containment, eradication and recovery, and post-incident activities.
Severity levels and response times
First response in 30 minutes or less for a critical incident, 1 hour for a high one, 4 hours for a medium one and 1 business day for a low one.
Communication with the client company
The case is logged in the Clikma help center, which notifies the company of every status change and every comment.
Post-incident review
Every incident is closed with a root cause analysis and actions to keep it from happening again.
Control map: NIST CSF 2.0 and ISO/IEC 27001:2022
The table relates the controls described on this page to the functions of the NIST Cybersecurity Framework 2.0 and to the control themes in Annex A of ISO/IEC 27001:2022. It is a reading guide for your assessment, not a statement of certified compliance.
| NIST CSF 2.0 function | ISO/IEC 27001:2022 Annex A theme | Clikma controls |
|---|---|---|
| Govern | Organizational controls: roles, responsibilities and supplier relationships | Incident response team with defined roles; support model with severity levels and escalation; committed availability and response times. |
| Identify | Organizational controls: asset inventory and change management | Infrastructure and services declared in versioned repositories; separate environments. |
| Protect | Technological controls: access control, authentication, cryptography and secure development | Single sign-on, second factor, password policies, IP allowlists, roles; encryption in transit and at rest; change review and static analysis. |
| Protect | Physical controls: data center security | Managed by the cloud provider where the platform runs. |
| Detect | Technological controls: event logging and monitoring | Field-by-field change audit; centralized logs; availability monitoring and alerts. |
| Respond | Organizational controls: information security incident management | Response team using the NIST SP 800-61 method; severity levels and response times; post-incident review. |
| Recover | Technological and organizational controls: backup, redundancy and continuity | Daily backup and 14-day recovery; standby replica; documented cluster rebuild. |
Frequently asked questions
Is Clikma a secure platform?
Clikma protects access with single sign-on, a second factor, password policies and IP allowlists per company, records every change field by field, encrypts data in transit and at rest, keeps daily backups with 14-day recovery and has an incident response team that works with NIST SP 800-61.
Is Clikma ISO 27001 certified?
This page describes Clikma's controls and how they relate to ISO/IEC 27001:2022 and the NIST Cybersecurity Framework 2.0; it is not a certification statement. If your vendor assessment requires a certificate or an audit report, ask the sales team and we will tell you what documentation is available.
Where is Clikma's data hosted?
The platform and its production database operate in Google Cloud, in the Santiago de Chile region. Backups and some support services are explained on the data protection page.
Is the data encrypted?
Yes. It travels over HTTPS with TLS and is stored with the encryption at rest that the cloud provider applies to the database, backups and files.
Does Clikma have single sign-on and two-factor authentication?
Yes. Single sign-on is set up with SAML 2.0 or LDAP together with the company's identity provider, and the second factor, with an authenticator app, is turned on per company and per user.
What happens if a security incident occurs?
Clikma's incident response team handles it with the NIST SP 800-61 method. The first response to a critical incident arrives in 30 minutes or less, the company receives every update through the help center, and the incident is closed with a root cause analysis.
How are access and changes logged?
Every data change is recorded field by field with its author, read-only impersonation leaves a record of the reason, start and end, and the logs of all services are gathered in one place.
Can I run a security assessment of Clikma?
Yes. The sales team coordinates it with Clikma's technical team. This page, the architecture page and the data protection page answer most of the usual questions in a security questionnaire.
Next steps: how to get started with Clikma
If you are evaluating a platform to train, assess and measure your people, this is the usual path.
Book a meeting
On the contact page you pick a time on the calendar, or you can write to contact@clikma.com or message us on WhatsApp at +56 9 7960 1634, Monday to Friday from 09:00 to 18:00.
See a demo with your use cases
We walk through the features you care about, with your processes and your numbers.
Define the scope and implementation
With a project manager, the scope, timelines and roles are set; the HR system is connected, single sign-on is configured and the training history is loaded.
Pilot run and ongoing support
Before opening it to the whole company, everything is checked and adjusted in a pilot run; after that, the Clikma team keeps supporting the operation.
Get to know Clikma with your own use cases
In a demo we walk through the features you care about, with your processes and your numbers.
Book a Demo