ClickUp Security and Compliance: What the Certificates Cover, and What Stays Your Job

Quick answer

ClickUp publishes SOC 2 audit certification, ISO 27001, 27017 and 27018, ISO 42001 for AI management, PCI DSS compliance, and GDPR alignment, with data encrypted in transit and at rest on AWS. Those cover ClickUp's side of the line. Your own Workspace still ships with 2FA, SSO, and session expiry switched off.

Every serious software purchase in the Gulf passes through the same gate. Somebody in risk sends a spreadsheet, the spreadsheet asks whether the vendor is certified, and the deal waits while somebody hunts for a PDF. Reasonable question — and on its own, the wrong one. A certificate answers for the vendor's half of the system, and nearly every incident we have seen in a work management tool happened in the other half: a Space that was public because public is the default, a client link that never expired, a contractor who left in March and still had an active session in June.

This is the eighth article in our product-education series. It covers what ClickUp publishes about its own security posture, what those publications actually cover, and the settings inside your Workspace that no certificate can vouch for. We are precise about the boundary at the end, because part of this subject belongs to your legal counsel rather than to any partner, including us.

What ClickUp publishes, in its own words

ClickUp is hosted entirely on Amazon Web Services, in a fully redundant environment with access restricted to operations support staff. Data in transit is encrypted with TLS 1.2 or higher; data at rest with AES-256, keys managed through AWS KMS. ClickUp says it monitors security and availability around the clock, runs automated security testing continuously, contracts an independent third party for penetration testing, and operates a bug bounty programme.

On certifications, it states it has achieved audit certification for SOC 2 Trust Services Principles focused on security, with controls independently audited at least annually. It lists ISO 27001, ISO 27017, and ISO 27018, and — more recently — ISO 42001, the standard for managing artificial intelligence responsibly. It maintains ongoing PCI DSS compliance, states that all plans meet current global data protection legislation including GDPR, LGPD, CCPA as amended by CPRA, and VCDPA, and publishes a Data Protection Addendum and a subprocessor list. HIPAA can be supported through a Business Associate Agreement.

One practical note for procurement: the SOC 2 report and the ISO certificates are not public downloads — ClickUp directs customers to request them from its sales team. Ask early; this is the most common reason a Gulf security review stalls at the last step.

Where your data actually lives, if you are in the Gulf

ClickUp stores and syncs customer data — tasks, Lists, Folders, Spaces, Docs, Goals, attachments, Automations — in one of five AWS regions: Oregon, Ohio, Sydney, Singapore, and Dublin. There is no Gulf region on that list, and ClickUp is explicit that it applies the same safeguards to data everywhere. It also offers localized data hosting, letting eligible customers store data only in the US, only in the EU, only in Singapore, or only in Australia, at no additional charge and never changing region without consent. Availability depends on your plan, so confirm it against the current documentation. The detail that matters here: customers in the UAE, Qatar, and Kuwait who qualify for localized hosting are assigned automatically to the Singapore data centre.

Read the exceptions carefully, because this is where reviews are won or lost. Integrations and Workspace avatars sit outside the selected region. User data such as login authentication, Notes, and Reminders lives in the global region. Some features are processed outside the region entirely when they depend on a subprocessor — AI is the named example. If your policy says "data must remain in region", the accurate reading is that core Workspace data can be pinned to Singapore while parts of the surrounding service are not pinned at all. Write that down honestly rather than ticking a box you will have to defend later.

The certificate covers ClickUp's half; your Workspace ships open

A SOC 2 report or an ISO 27001 certificate demonstrates that the vendor operates a documented, audited set of controls over the infrastructure and organisation it runs. It says nothing about whether your finance Space is public, whether a former employee still holds a seat, or whether your salary review Doc has a shareable link sitting in somebody's WhatsApp history. That is the shared-responsibility model every cloud service runs on, and it is the half that questionnaires consistently under-test.

ClickUp documents its defaults plainly, and they are permissive because a brand-new Workspace should not lock its first user out. Two-factor authentication: not required. Single sign-on: not required. Session duration: never expires. Idle timeout: never expires. Chat data retention: never expires. New Spaces are public unless you change the setting. None of that is wrong for a five-person startup in its first week; every bit of it is wrong for a fifty-person company handling client data eighteen months later — and nobody receives a notification the day it stops being appropriate.

The settings to change before your next security review

Owners and admins find these under the Workspace avatar, then Settings, then Security & Permissions. Some are available on every plan and some are tied to plan level, so treat this as a checklist to work through rather than a promise about what you will see.

• Require two-factor authentication, or SSO if you run an identity provider. Without either, ClickUp emails users on every login with date, email, IP, and location — a detection control, not a preventive one.
• Set a session duration and idle timeout instead of leaving both at never. This is the control that most changes what happens when a laptop is lost or a contractor's engagement ends.
• Turn on Block public sharing, which deactivates links older than a year, never-expiring links, and public template sharing. Note its documented limit: it does not stop attachment URLs from being shared.
• Turn on Private Attachment Links so opening an attachment requires being logged in to the Workspace. ClickUp lists this as a beta rolling out gradually, so check whether it is live for you.
• Consider making new Spaces private by default, and decide deliberately whether admins may manage private Spaces and private Custom Fields — an owner-only decision that notifies the whole Workspace when activated.
• Set Chat data retention to a defined window (30, 90, 180, or 360 days) if your policy requires one, and use Account Authenticated Forms where intake should only be visible to people inside your Workspace.

Audit logs turn an incident into a record

Workspace audit logs are the difference between proving what happened and believing what somebody remembers. ClickUp separates them into logs for users, tasks, Custom Fields, hierarchy, Agents, and a small "other" category; every entry carries a date, user, role, event, and status, with an expandable event log holding the raw detail including client IP.

The user log is the one a compliance officer will want, because it records the events that matter after somebody leaves or something breaks: logins and logouts, 2FA policy changes, SSO configuration changes, bypass SSO being enabled, role and permission changes, users provisioned and deprovisioned through SCIM, invitations, and app connections created or removed — including connections to external MCP servers. Super Agent actions appear in the task, field, and hierarchy logs; Autopilot Agent activity is recorded in the Automations log.

Two things to plan for. Availability and limits vary by plan and role — members and guests cannot view logs at all, though owners can extend viewing to admins through a custom role. And ClickUp documents an honest gap: app connection events do not currently identify who created or removed a personal third-party connection. Logs export through the API, which is how you get them into whatever system your auditor reads.

AI has become part of the questionnaire

Gulf reviewers now ask the sharpest version of the AI question first: does our data train somebody else's model? ClickUp's published position is that its AI partners are prohibited from training on customer data, that ClickUp AI operates through in-context learning without permanently storing Workspace information, and that there is zero third-party data retention. ISO 42001 is the external evidence it points to for how that is governed, and it publishes an AI security FAQ, AI additional terms, a DPA, and a subprocessor list with hosting locations — cite those rather than any partner's paraphrase, including this one.

The second half is permissions. ClickUp states its permission model extends to AI: Brain cannot surface anything the asking user could not open themselves, and Agents only see and act on what they have been granted. That is the right design — and it means your AI exposure is exactly as good as your permission hygiene. An over-shared Space becomes an over-answering assistant. Fix permissions first, then turn on AI.

Where our advice stops and your lawyer's begins

We can tell you what ClickUp publishes, configure the Workspace to match your policy, and produce the evidence your reviewer wants. We cannot tell you whether a given configuration satisfies the UAE's federal personal data protection law, Qatar's data protection law, Kuwait's data privacy regulations, or the sector rules that apply if you are a bank, an insurer, a healthcare provider, or a government entity. Those are legal determinations about your organisation, your data categories, and your role as controller or processor — and they change. Anyone who answers "yes, it is compliant" without reading your data map is selling you a sentence, not an assessment.

The useful path is the ordinary one, and it fits in a month. Request the SOC 2 report and ISO certificates, take the DPA and subprocessor list, and confirm your hosting region in writing. Fix authentication, then reconcile your seat list against HR's leaver list — in most Gulf companies the fastest way to find three accounts nobody expected. Close the sharing surface, and turn on the evidence layer before you need it. Then hand that package to counsel. Building it is our job; the determination is theirs.

How BuyClickUp helps

BuyClickUp is an independent ClickUp partner operated by Inspark, working with organisations across the UAE, Qatar, and Kuwait, with our sister company Dtech serving Saudi Arabia. We handle ClickUp licensing with local, procurement-friendly invoicing, and we run Workspace security reviews with IT and operations together — configuring the controls above, assembling the evidence pack your reviewer asks for, and documenting it in English and Arabic.

If a security questionnaire is currently sitting between you and a rollout, start with our free readiness assessment or reach us through the contact page. We are not your legal advisors, and we will say so in writing — but we can make sure the technical answers in that questionnaire are accurate and evidenced.

Next in this series: what ClickUp 4.0 changed, and which of those changes actually alter how a Gulf team works day to day.