I85PREP
⌘ K
ClickUp Certification study materials
ClickUp Certification study resources

ClickUp Certification: Data, privacy, and security

ClickUp Certification · Work through your exam, one topic at a time.

All guide sections

Data, privacy, and security

Data, privacy, and security

This domain tests who can see what, how access is granted and revoked, and the compliance and AI data rules behind the platform.

Access and protection

  • Workspace roles are Owner, Admin, and Member. Guests are a separate, narrower identity scoped item by item.
  • Access flows through private Spaces, item-level sharing, and permission levels such as Full, Edit, Comment, and View. Inheritance runs downward and can be overridden lower in the tree.
  • Authentication controls include SSO through SAML providers such as Okta, Entra, or Google, two-factor authentication, SCIM provisioning, session policies, and audit logs on higher tiers.
  • Data is encrypted in transit and at rest. Compliance attestations include SOC 2 Type II and GDPR support with a DPA, and HIPAA is available under a BAA on Enterprise.
  • AI features respect permissions: Brain and Agents only reach content the acting identity can access, and customer content is not used to train third-party models. Administrators can disable AI.
  • API tokens are credentials. Rotate them, assign them to scoped service identities, and never ship them in client-side code.

Worked example

A contractor joins for one project. Invite them as a Guest, share only the project List at Edit level, and do not add them to the Space. Verify the result on the item's sharing panel. The reasoning: a Guest with item-level access has the smallest possible footprint, while a Member added to the Space would inherit everything the Space exposes, including Lists the contractor should never see.

Traps that cost marks

  • Treating Guest and Member as interchangeable, then over-sharing an entire Space.
  • Assuming removing someone from a Space removes them from the workspace. Membership and item sharing are separate.
  • Assuming deletion is instantaneous everywhere, including backups and replicas.
  • Reading SOC 2 as covering HIPAA. HIPAA requires a BAA and specific configuration.
  • Forgetting that enforcing 2FA on logins does not neutralise an over-privileged API token.