Security Compliance Roadmap

Overview

Close-Rate’s security compliance today, with some of the controls that are in place and some that are not.

SOC 2

Close-Rate does not hold a SOC 2 report. A SOC 2 audit has not started, and no date is set for one.

A SOC 2 report is an independent auditor’s opinion on a company’s security controls. It is a report, not a certification.

ISO 27001

Close-Rate does not hold ISO 27001 certification. Work toward it has not started, and no date is set.

In Place Today

• Call transcripts are encrypted at rest in Amazon S3 (AES-256), and so is our database (Amazon Aurora).

• Traffic between your browser and Close-Rate, and between Close-Rate and its providers, uses TLS 1.2 or higher. Database connections use TLS. Traffic from our load balancer to the application stays inside our private AWS network and is not separately encrypted.

• Sign-in is handled by Clerk. Requests to our API for a workspace’s data must carry a valid signed token (an RS256 JWT).

• Customer requests are checked against the workspace of the person making them, in our application code. Close-Rate staff can open a customer’s workspace to support that customer, and our internal admin tools and background jobs can read across workspaces.

• Coaches can see their whole workspace. A rep’s own lists and reports show only that rep’s calls; a rep can also open any call in their workspace when they have its link.

• Zoom and RingCentral access tokens are encrypted before they are stored, with a key kept in AWS Secrets Manager rather than in the database. Both connections ask for read-only access.

• Database queries pass the values they are given as bound parameters.

• Most API routes validate their input against a typed schema.

• API requests are rate-limited for each signed-in user.

• The production database is not reachable from the public internet and is backed up automatically, with seven days of point-in-time recovery. Transcript files in S3 are not versioned.

• Our deploy workflow requires the automated tests to pass on the exact commit being released.

• Dependency audits (pip-audit for Python, npm audit for JavaScript) run in our automated checks whenever a change can affect the code they cover. A Python package with a known vulnerability that has a fix fails those checks, unless we have recorded why its upgrade can wait and a date to review it. JavaScript audit results are reported and do not block a release. Container images are scanned when they are pushed to our registry.

• AWS, Clerk, Anthropic, OpenAI and AssemblyAI each have a SOC 2 report of their own. Those reports cover those companies, not Close-Rate.

Not in Place Today

• No independent penetration test has been done.

• No web application firewall sits in front of our API.

• Our build does not run static security analysis on our own code.

• Rate-limit counts are kept separately by each server process, not in one shared store.

• We do not keep an audit log of who viewed which customer record.

• We have not carried out a formal, recorded review of who has access to our AWS account and database credentials.

Questions

If you have questions about our security, contact us at client-services@close-rate.com.