Closr holds your calendar, your mailbox, your customer records, and recordings of your calls. This page describes how that is protected — in specifics, not adjectives.
Email and password, Google, or Microsoft. Sessions are verified against published signing keys using asymmetric tokens — the server never holds a shared signing secret that could be leaked.
The server owns session refresh and the browser follows it, on a sliding 30-day cookie. That removes the class of bug where two clients race to refresh and log you out.
Organization admins and members see different surfaces. Plan gates and AI token caps are enforced server-side on every request, not hidden in the interface.
Calendar and mailbox access is granted over OAuth and limited to the scopes each feature needs. Google restricted scopes — the ones covering mailbox contents — are subject to Google’s own verification process, and the connection can be revoked from your Google or Microsoft account at any time without touching Closr.
Disconnecting a provider stops the sync immediately. Data already captured onto a contact timeline remains yours to keep or delete.
Calls placed through the public website voice agent sit behind an explicit consent gate, and recording is a per-project setting rather than a global default.
Agents answer from knowledge-base documents you approved. Documents have a draft and a live state, and only live documents are retrieved at runtime.
Allowed topics, forbidden topics, and required disclosures drive the live agent, with escalation to a human as an explicit action whose wording is decided server-side.
AI consumption is tracked per account against a monthly cap. There is no path for one account's usage to silently draw on another's.
Closr does not currently hold SOC 2 or ISO 27001 certification, and we would rather say so here than let a procurement conversation find out later. If your organization requires a formal audit report, contact us and we will tell you where we are and what we can provide in the meantime — architecture detail, data-flow descriptions, and answers to a security questionnaire.
If you believe you have found a vulnerability, report it through the contact form and we will respond within one business day. Please do not test against other customers’ accounts.
Send it over. We answer them ourselves rather than routing you to a portal.
Replies within one business day.