Security
Security at Closefinch
Last updated: November 8, 2026.
Closefinch holds teams' email, calendars, CRM records and recordings, and can send messages for them. These are the controls that protect that, and the ones you can turn on yourself.
Data protection
Each organization's data is kept apart
The database itself separates each organization's records, and the app runs as a role that can't switch that off. Work that has to cross organizations, such as key lookups and background jobs, runs under a separate, fenced role; any new use of it needs review, and its volume is monitored.
Encrypted in transit
Every connection to the site, the app and the API uses TLS.
Stored credentials encrypted
Tokens and keys for the accounts you connect are encrypted (AES-256-GCM) under versioned keys we can rotate without downtime, and they're deleted when you disconnect. API keys are stored only as hashes.
Where your data lives
Our servers, database and backups are in Germany, and backups are encrypted. The subprocessor list shows what is processed elsewhere, and where.
Agents ask first
Emails, texts and other actions an agent takes outside the app pass the policy checks and, by default, wait for a person's approval. Content from outside (emails, web pages) can't make an agent send anything on its own. Website chat and voice agents answer live, within the limits you set.
Access and identity
Two-step sign-in
With an authenticator app or a passkey, and backup codes. Owners need it to use owner settings, whichever way they sign in.
Passkeys
Sign in with a passkey instead of a password, or use one as the second step.
Single sign-on and SCIM
Sign in through your own identity provider (OIDC), and add and remove people with SCIM. Set up in Settings → SSO.
Password checks
Passwords found in known breaches are refused, and repeated failed sign-ins lock the account for a while.
Sessions you can see
A list of your signed-in sessions, and sign-out everywhere.
Roles and access
Owner, member and viewer roles, with access set by data source, agent, role and team, including which AI tools can see which data.
Admin and audit
Audit log
Every change by a person or an agent is recorded, including each use of a connected account's credentials. The log is tamper-evident and checked every hour.
Scoped API keys
Each key gets only the scopes it needs, never more than the person who made it, and stops working when they leave. Sending messages to contacts needs an explicit send scope.
Keys that expire
Keys expire after 90 days by default (up to 365), with reminders before they do. A key that never expires is an owner's explicit, recorded choice.
IP allowlists
Limit a key to the addresses you list; a request from anywhere else is refused and recorded.
Sign-in for scripts
The command line signs in with a short code in your browser, so you don't need to paste a long-lived key.
Monitoring and alerts
Suspicious sign-ins, key misuse and spam raise alerts, and outbound sending can be stopped at once.
Privacy
Your data isn't sold or used to train models
We don't sell it, and neither we nor our AI providers train their models on it. A feature you choose that makes something from your own material, such as a video replica of a teammate, uses only that material, with their written consent.
Subprocessors and a DPA
A published subprocessor list, and a DPA with 30 days' notice before a new subprocessor.
Export and deletion
Owners can ask us for a full export of the organization's data. When you disconnect an account, its tokens are deleted, and an owner can also have everything that came from it deleted, search data included. Deleting the organization suspends it at once, lets an owner undo it for 30 days, then purges it.
Staff access
Our own staff's access is limited to what operating the service needs, and it's recorded.
How we build and run it
Secure development
Dependencies are pinned and approved one by one, changes are checked by automated tests and a scan for leaked secrets, and each release passes an independent review before it ships.
Incident response
A written incident plan with drills on a schedule, and notice to you within 48 hours of a personal data breach that affects your data. Restore drills from backups are scheduled every quarter.
Certifications
None yet, and we don't show a badge we haven't earned. We plan SOC 2 when customers need it. Contact us for our security questionnaire answers.
Reporting a vulnerability
Email security@closefinch.com with the details and how to reproduce them. We'll:
- acknowledge within 2 business days;
- keep you informed;
- not pursue good-faith research that respects people's privacy and data, avoids disruption, and gives us reasonable time to fix before you disclose.
Out of scope: denial-of-service, social engineering, physical attacks, and reports from automated scanners without a working proof. Machine-readable contact details are at /.well-known/security.txt.
Questions about security?
Ask for our security questionnaire answers, or read how we handle personal data.