Security and your data

We keep your email, your territory, and a detailed record of how you use the site and app, including session replays of what you type. Here is where that lives and how it is handled, as this build works today. We list what we don't have too.

Where it runs

The site and the app run on Fly.io servers in Ashburn, Virginia.
Accounts, territories and the published findings are stored in Convex, a hosted database, in its US East (Northern Virginia) region.
The engine that reads public records also runs on Fly.io in Ashburn, Virginia, and keeps its copies of those records on its own encrypted disk there. It holds no account data and sends its findings in through one ingest token.
Email from us goes out through Resend, from Amazon's US East (Northern Virginia) region.
Alerts about your sign-up, downloads, call requests, wrong-record notes and feedback, with the details you gave, are emailed to our company inbox on Google Workspace. Email you send to hello@closurelead.com lands there too, passed on by Forward Email.
Analytics and session replays are stored by PostHog on its EU cloud, in Frankfurt, Germany.
Payments, once card checkout opens, go through Stripe. Your card number stays with Stripe.
Our code is in private GitHub repositories. It holds no customer data.
Helios One Oy (business ID 3596623-5) is a Finnish company. It runs closurelead and is responsible for your data.

In your browser

Every page is served over HTTPS only. Browsers are told to use HTTPS with us, on every subdomain, for two years (HSTS).
Each page sends a content security policy that allows only our own scripts and PostHog's analytics script. Other sites can't frame our pages.
Our pages are not allowed to use your camera, microphone, location, payment or USB features (Permissions-Policy).

Signing in and downloads

You sign in with a 6-digit code sent to your email address. Each code is random and works for 15 minutes.
There are no passwords, so there is no password of yours for us to store or lose.
Email code is the only way to sign in.
Download links for CSV and PDF exports are signed and stop working after 7 days.

Payments

Card payment is not switched on yet, and the trial needs no card. When it is, you will pay on Stripe's checkout page: your card number will go to Stripe and never reach our servers.

Analytics and session replay

We use PostHog, on its EU cloud, to see how the site and app are used. The data goes through our own domain first.
We record sessions: pages, clicks, scrolling and what you type into forms. Password fields and fields we mark as secret (such as sign-in codes) are masked.
Replays also keep the page's console messages and the network requests it makes, with their headers and bodies.
Replays are deleted after 30 days. Analytics events are kept for up to 7 years.

The privacy policy lists each cookie and browser storage key we set, and what each is for.

Email

Email from us, such as sign-in codes, file copies and the weekly feed, goes through Resend, our email provider. Every feed and onboarding email has a signed unsubscribe link, and it works without signing in.

Keys and access

Secret keys live in our own secrets vault and in the secret stores of the services that need them (Fly.io, Convex and GitHub). None is in our source code or in the pages you load.
Each page does carry PostHog's public project key. It can only send analytics events, not read them.

What we don't have

We have no SOC 2 or ISO 27001 report. We are a small team.
If your company needs a security questionnaire answered, book a call.

How long we keep things, and deletion

Your account, territory and messages are kept while you have an account with us.
To get a copy of your data, or to have it deleted, email hello@closurelead.com from the address you use with us.
There is no self-serve tool yet. Each request goes to Touko Ursin, co-founder. We delete your account data from our database, your profile and recordings from PostHog, and the alerts and messages about you from our email, and confirm by email when it is done.

Report a security issue

Email hello@closurelead.com. Each report goes to Touko Ursin, co-founder (about us). Please give us time to fix a problem before you share it. The same contact is in /.well-known/security.txt.