# Security at Closefinch

Last updated: November 8, 2026.

Closefinch holds teams' email, calendars, CRM records and recordings, and can send messages for them. These are
the controls that protect that, and the ones you can turn on yourself.

## Data protection

- **Each organization's data is kept apart.** The database itself separates each organization's records, and the
  app runs as a role that can't switch that off. Work that has to cross organizations, such as key lookups and
  background jobs, runs under a separate, fenced role; any new use of it needs review, and its volume is monitored.
- **Encrypted in transit.** Every connection to the site, the app and the API uses TLS.
- **Stored credentials encrypted.** Tokens and keys for the accounts you connect are encrypted (AES-256-GCM) under
  versioned keys we can rotate without downtime, and they're deleted when you disconnect. API keys are stored only
  as hashes.
- **Where your data lives.** Our servers, database and backups are in Germany, and backups are encrypted. The
  [subprocessor list](https://www.closefinch.com/subprocessors) shows what is processed elsewhere, and where.
- **Agents ask first.** Emails, texts and other actions an agent takes outside the app pass the policy checks and,
  by default, wait for a person's approval. Content from outside (emails, web pages) can't make an agent send
  anything on its own. Website chat and voice agents answer live, within the limits you set.

## Access and identity

- **Two-step sign-in.** With an authenticator app or a passkey, and backup codes. Owners need it to use owner
  settings, whichever way they sign in.
- **Passkeys.** Sign in with a passkey instead of a password, or use one as the second step.
- **Single sign-on and SCIM.** Sign in through your own identity provider (OIDC), and add and remove people with SCIM.
  Set up in Settings → SSO.
- **Password checks.** Passwords found in known breaches are refused, and repeated failed sign-ins lock the account
  for a while.
- **Sessions you can see.** A list of your signed-in sessions, and sign-out everywhere.
- **Roles and access.** Owner, member and viewer roles, with access set by data source, agent, role and team,
  including which AI tools can see which data.

## Admin and audit

- **Audit log.** Every change by a person or an agent is recorded, including each use of a connected account's
  credentials. The log is tamper-evident and checked every hour.
- **Scoped API keys.** Each key gets only the scopes it needs, never more than the person who made it, and stops
  working when they leave. Sending messages to contacts needs an explicit send scope.
- **Keys that expire.** Keys expire after 90 days by default (up to 365), with reminders before they do. A key that
  never expires is an owner's explicit, recorded choice.
- **IP allowlists.** Limit a key to the addresses you list; a request from anywhere else is refused and recorded.
- **Sign-in for scripts.** The command line signs in with a short code in your browser, so you don't need to paste a
  long-lived key.
- **Monitoring and alerts.** Suspicious sign-ins, key misuse and spam raise alerts, and outbound sending can be stopped
  at once.

## Privacy

- **Your data isn't sold or used to train models.** We don't sell it, and neither we nor our AI providers train
  their models on it. A feature you choose that makes something from your own material, such as a video replica of a
  teammate, uses only that material, with their written consent.
- **Subprocessors and a DPA.** A published [subprocessor list](https://www.closefinch.com/subprocessors), and a [DPA](https://www.closefinch.com/dpa) with 30 days'
  notice before a new subprocessor.
- **Export and deletion.** Owners can ask us for a full export of the organization's data. When you disconnect
  an account, its tokens are deleted, and an owner can also have everything that came from it deleted, search data
  included. Deleting the organization suspends it at once, lets an owner undo it for 30 days, then purges it.
- **Staff access.** Our own staff's access is limited to what operating the service needs, and it's recorded.

## How we build and run it

- **Secure development.** Dependencies are pinned and approved one by one, changes are checked by automated tests and
  a scan for leaked secrets, and each release passes an independent review before it ships.
- **Incident response.** A written incident plan with drills on a schedule, and notice to you within 48 hours of a
  personal data breach that affects your data. Restore drills from backups are scheduled every quarter.

## Certifications

None yet, and we don't show a badge we haven't earned. We plan SOC 2 when customers need it.
[Contact us](mailto:security@closefinch.com) for our security questionnaire answers.

## Reporting a vulnerability

Email security@closefinch.com with the details and how to reproduce them. We'll:
- acknowledge within 2 business days;
- keep you informed;
- not pursue good-faith research that respects people's privacy and data, avoids disruption, and gives us
  reasonable time to fix before you disclose.

Out of scope: denial-of-service, social engineering, physical attacks, and reports from automated scanners without
a working proof. Machine-readable contact details are at [/.well-known/security.txt](https://www.closefinch.com/.well-known/security.txt).