# Security, admin and compliance

Roles and fine-grained access, an audit log of every action, two-step sign-in and passkeys, scoped API keys, and consent and opt-out records across email, SMS and calls.

A note in italics after an item says when it's off by default, or needs your own account with another service. Every area: the [product overview](https://www.closefinch.com/product).

## Sign-in and keys

- Two-step sign-in with an authenticator app and encrypted backup codes, required for owners.
- Session list and sign-out everywhere.
- Breached-password check.
- Sign-up abuse controls and trial limits.
- Per-org send ramp and reputation.
- Detection rules engine over audit and security events.
- Hash-chained audit log with hourly verification.
- Platform-wide kill switches and org freeze.
- Incident runbook, breach notification and drills.
- Passkeys (WebAuthn) for sign-in and as the second step; required for operators, offered to owners and members, with TOTP kept as a fallback.
- API keys expire by default (90 days, up to 365; no expiry only as an owner's explicit choice, recorded) with reminders to the creator 14 and 3 days before.
- CLI sign-in through the OAuth device flow with a built-in first-party client, so nobody needs to paste a long-lived API key; keys stay for CI.
- Per-key address allowlist (CIDR ranges): a request from elsewhere is refused and recorded as a security event.
- Fine-grained API scopes per resource and action, with named bundles; sending always needs an explicit send scope.
- Log each use of a connected-account credential: which connection, for which job or request, by which person or agent, kept with the audit log.
- Each production process gets only the secrets it uses (the web app gets no encryption keys or system database password), checked at start-up.

## Admin and data controls

- Roles (Owner, Member, Viewer) with owner-only settings for pipelines, notification policy, API keys and org integrations.
- Granular access by data source, agent, user role and team, including which AI tools can see which data.
- Single sign-on through OIDC, and SCIM provisioning. *(Connects to your own identity provider.)*
- Audit log of every query and action, including MCP queries, mapping approvals and per-decision reviewer and time.
- Notification policy: per-event, per-channel org defaults and force-off locks, with personal preferences.
- Scoped API keys and partner OAuth apps.
- Logical multi-tenancy with each organization's data isolated, and separate deployments per region.
- AES-256-GCM encryption of stored credentials and secrets under a versioned keyring with rotation and re-wrap; OAuth tokens deleted on disconnect and revoked at the provider once no other connection uses the grant; write scopes asked only when sending is allowed.
- Data deletion on disconnect (embeddings and caches removed) and bulk export windows.
- No training on customer data, zero-retention model options and training-provider exclusion on the model router.
- Several brands and workspaces in one account: up to 5 brands, and a workspace per team or market.
- Agent-governance layer: agent identity, permissions, auditability, workflow inventory, decision history and incident reports.
- Org deletion with a 30-day pending window: the org is suspended at once, every owner is emailed, an owner can undo it, and it's purged when the window ends.

## Consent and compliance

- Global do-not-contact list: named exclusions, CSV upload, matching across identifiers, rejected or deselected people auto-added.
- Unsubscribe detection in replies with automatic suppression and preservation of unsubscribe rules across agents.
- SMS keyword opt-out (STOP, UNSUBSCRIBE, CANCEL, END, QUIT and more), universal or per channel, logged with identifier, channel, keyword and time; HELP gets an information reply.
- Calling-window engine: calling hours in every time zone a contact may be in, federal holidays, per-state hours and daily caps, state-of-emergency blocks, and a queue for held calls.
- Do-not-call scrubbing against your own FTC registry file and internal list, with flagged numbers masked. *(Gryphon is optional and off.)*
- Required disclosures: AI, recording and business-identity lines at the start of every call, transfer, voicemail and recording-stopped announcements, and an optional AI sender name on email.
- Recording consent flow: first-use disclosure screen, explicit consent before recording, manual-notes fallback.
- Consent and opt-out status written back to the CRM; consent records available for audit.
- Card, SSN and bank-account redaction in transcripts before storage and model reads.
- Exportable compliance audit history and regulator-shaped governance reports.
- Unified per-contact consent and lawful-basis ledger spanning email, LinkedIn, SMS and voice.
- Touch-frequency cap per contact across channels.
- Known-relationship send gate: block or require approval for any outreach to a contact with no prior two-way interaction.

## Disclosures

- EU AI Act disclosure.