Security Policy

Overview

Close-Rate is built with security as a foundational principle. We handle sensitive sales conversation data on behalf of our customers, and we take that responsibility seriously. This document outlines the security controls, practices, and architecture that protect our platform and your data.

Encryption

In Transit

• All communications use TLS 1.2 or higher

• API endpoints are served exclusively over HTTPS via AWS ECS (Fargate) behind an Application Load Balancer

• Frontend assets served over HTTPS via AWS Amplify with CloudFront CDN

• HTTP requests are 301-redirected to HTTPS, and HSTS (Strict-Transport-Security) is enforced on API responses

• All third-party API calls (Anthropic, OpenAI, AssemblyAI, Zoom, Clerk) use HTTPS

At Rest

• Database: Amazon RDS PostgreSQL with AES-256 encryption enabled

• File Storage: Amazon S3 with server-side encryption (SSE-S3)

• Search Index: transcript search indexes (text chunks and embeddings) are stored in the same encrypted Amazon Aurora PostgreSQL database (pgvector), not in a separate search service

• OAuth Tokens: Encrypted using Fernet symmetric encryption before database storage, with a dedicated encryption key

Authentication & Authorization

• Authentication managed by Clerk.dev, an enterprise-grade identity provider

• All API requests require a valid JWT signed with RS256 (asymmetric keys)

• JWT tokens are validated on every request using Clerk's JWKS endpoint — expiration (exp), issued-at (iat), and issuer (iss) claims are all verified

• Role-based access control (RBAC): coach, sales, and admin roles — coach and admin have full organization access, while sales users can only access their own data

• Multi-tenant organization isolation — users can only access data belonging to their organizations

• OAuth 2.0 used for third-party integrations (Zoom) with minimal required read-only scopes

• Clock skew tolerance (30-second leeway) prevents false authentication rejections

Network Security

• Backend hosted on AWS ECS (Fargate) with managed networking and automatic scaling

• Database accessible only within the VPC — not exposed to the public internet

• Transcript search indexes live in that same database, inside the same private AWS network; there is no separate search endpoint

• CORS policy restricts API access to known frontend domains only

• No SSH or direct server access — infrastructure is fully managed

Access Control

• AWS IAM roles follow the principle of least privilege

• Production environment credentials are stored in AWS Secrets Manager and injected into ECS task definitions as environment variables, never in source code

• API keys and secrets are never logged or exposed in error messages

• Database credentials use URL-encoded complex passwords

• Integration tokens are stored encrypted and scoped to individual organizations

Application Security

• All database queries use SQLAlchemy ORM with parameterized queries — no raw SQL

• Input validation enforced via Pydantic models on all API endpoints

• Structured logging via Python's logging module — sensitive data is never logged

• Error responses return generic messages to clients — stack traces are only logged server-side

• File uploads restricted to supported audio/video formats with size limits

• Background tasks run in isolated async contexts with proper error handling

Vendor Security

We use established, audited vendors for critical services:

• Amazon Web Services: SOC 1/2/3, ISO 27001, PCI DSS Level 1, HIPAA eligible

• Clerk.dev: SOC 2 Type II certified, GDPR compliant

• Anthropic (Claude): Our primary analysis and reasoning model. It powers coaching-report generation and AI Insights chat over conversation transcript text. Anthropic's commercial terms say it may not train models on customer content sent through its services

• OpenAI: SOC 2 Type II certified. Used for text embeddings and auxiliary text processing. OpenAI says data sent to its API is not used to train its models unless the customer opts in to share it

• AssemblyAI: SOC 2 Type 2 report, audited annually by an independent firm. Used only to transcribe call audio. Since October 15, 2026, our account has been opted out of AssemblyAI's model improvement program, which AssemblyAI says means it does not use the call audio we send it to train its models or for benchmarking. The account is set so that AssemblyAI begins deleting each call's audio and transcript one day after the request; it keeps certain metadata for logging and billing, and its terms let it keep de-identified data made from the audio for purposes other than training its models

• Zoom: SOC 2 Type II, ISO 27001, FedRAMP authorized

Security Incident Reporting

If you discover a security vulnerability, please report it responsibly to client-services@close-rate.com. We commit to acknowledging reports within 24 hours and providing an initial assessment within 72 hours. See our Incident Response Policy for full details.