Security
A CRM holds your customers, your calls and your team’s day. We treat it that way.
Here is what CloseLoom does to keep your company’s data separate, private and in your hands. Every point below is enforced in the product today.
Your company’s data is yours alone
- Every company’s records are separated in the database itself by row-level security, enforced on every query, not only by the application
- A test suite tries to reach another company’s records through every endpoint, and the build fails if one answers
- A record outside your company or your view is simply not found: nothing confirms it exists
Signing in
- Passwords hashed with argon2id
- Two-factor sign-in with an authenticator app and ten recovery codes, on the web and the phone
- An admin can reset a colleague who lost their phone; there is no way around the second factor alone
- Sign-in attempts are limited, and a disabled account is signed out everywhere at once
Who sees what
- Owner, admin, manager and rep, each with its own permissions
- Reps see their own records or their team’s, as the company chooses
- A mailbox is read by its owner, their managers and admins; an admin opening somebody else’s is logged
- Call recordings and their transcripts are heard and read by managers and admins only, and every listen is logged
- An activity log of who changed what, kept permanently
The company phone
- Calls with numbers on no record never leave the phone unless the company asks for every call and the rep agrees on the phone
- Texts are kept only when the company asks and the rep agrees, from that moment on, and never from banks, short codes or one-time passwords
- Location is recorded only if the company turns it on and the rep consents, and only during working hours
- A phone that is signed out remotely clears the company’s data from itself
Secrets and files
- Everything travels over HTTPS
- Your SMTP, SMS and WhatsApp credentials are stored encrypted and never shown again
- API keys are stored as hashes and shown once; a key can never do more than the person who made it
- Files are handed out through short-lived signed links, and uploads are judged by their contents, not their names
- Outgoing webhooks are signed so your systems can tell they came from us
Keeping and leaving
- Set how long location pings, call recordings and webhook deliveries are kept
- Export all your company’s data whenever you ask, as a download
- Deleting the company waits a week, can be called off, and then removes everything
Services we rely on
Files such as visit photos, recordings and marketing material are kept in Backblaze B2 object storage. Messages go out through the providers your company sets up. When a company turns on call reviews, recordings are transcribed by a speech-to-text service and reviewed by Anthropic’s Claude, which does not train its models on them. Found a problem? Write to us from the Contact page.
Questions about your data?
We will walk your IT team through how CloseLoom handles it, before you put a single lead in.