Security
How CloseNote protects your data · Last updated: May 2026
CloseNote is built for sales teams who trust us with call content and CRM credentials. This page describes our technical controls in plain language. For data collection and subprocessors, see our Privacy Policy.
Security at a glance
- Authentication: bcrypt password hashing, signed session cookies (HttpOnly, Secure, SameSite=Lax), session invalidation on password change or reset.
- Encryption at rest: Fernet (AES-128-CBC + HMAC-SHA256) for transcripts, AI notes, and Salesforce OAuth tokens.
- Transport: TLS (HTTPS) terminated at Railway and Cloudflare before traffic reaches the app.
- Application: CSRF tokens on all state-changing requests, OAuth state bound to your account, rate-limited auth and upload/AI endpoints, Content-Security-Policy headers.
- Audio: Deleted after transcription completes (success or failure); 50 MB upload cap; orphaned files cleaned on startup and call delete.
- Your control: Disconnect Salesforce anytime; permanently delete your account and all associated data from Settings.
Passwords
Passwords are hashed with bcrypt before storage. We never store or transmit plain-text passwords. Password reset links are one-time use and invalidate existing sessions when a new password is set.
Encrypted storage
Call transcripts, AI-generated note fields (summary, pain points, objections, next steps, follow-up notes), and Salesforce OAuth tokens are encrypted at rest using Fernet. Contact name, company, and phone number are stored in plaintext for display and CRM matching.
Audio handling
Audio is uploaded temporarily for transcription, then deleted once processing completes (success or failure). Upload files are not web-accessible. Orphaned files are removed on app startup and when calls are deleted.
HTTPS / TLS
All public traffic uses HTTPS. Railway and Cloudflare terminate TLS at the edge. The app sets Strict-Transport-Security (HSTS) headers in production.
Salesforce OAuth
We connect via OAuth 2.0 with PKCE (S256). We never see your Salesforce password. OAuth state is cryptographically bound to your CloseNote session to prevent account-linking attacks. Tokens are encrypted at rest. Disconnect anytime from Settings.
Security headers
Responses include Content-Security-Policy, X-Frame-Options (DENY), X-Content-Type-Options (nosniff), Referrer-Policy, Permissions-Policy, and HSTS in production to reduce XSS, clickjacking, MIME sniffing, and related attacks.
Rate limiting
Login, signup, forgot-password, and password reset are limited to 10 attempts per 15 minutes per IP address. Uploads, transcription, and note generation are limited to 60 per hour per account.
CSRF protection
Every form POST and API mutation requires a signed CSRF token tied to your session. Fetch requests (upload, transcription) send the token via header.
Upload limits
Audio uploads are capped at 50 MB per file. Only recognized audio formats are accepted (WebM, OGG, WAV, MP4, M4A, MP3). Filenames are server-generated; uploads are stored outside the public web root.
Account deletion
Delete your account from Settings (password + confirmation required). This permanently removes your user record, all calls, transcripts, notes, feedback, and Salesforce tokens.
AI processing
Transcription uses Groq (Whisper). Note generation uses OpenAI. Only the data needed for each step is sent. We do not use your call content to train models. See subprocessors in our Privacy Policy.
Infrastructure
Hosted on Railway (United States) with PostgreSQL for persistent storage. Production requires APP_SECRET and ENCRYPTION_KEY environment variables; the app refuses to start without them.
Access control
- Each user can only access their own calls and notes. Every request verifies call.user_id == session.user_id.
- Admin endpoints are restricted to a configured admin email and return 404 for everyone else.
- Diagnostic endpoints (/health/ai, /health/db) are admin-only in production.
- Salesforce record IDs are validated before notes are pushed. Search input is sanitized before SOQL queries.
Sessions & cookies
- Session cookies are signed with APP_SECRET, marked HttpOnly, and Secure in production.
- Sessions expire after 14 days. Changing or resetting your password invalidates all existing sessions.
- Salesforce OAuth uses a short-lived (15 min), HttpOnly cookie to bind the OAuth flow to your account.
What we are working toward
We are honest about current limits as we grow:
- Self-hosted Tailwind CSS with stricter CSP (nonces, no unsafe-inline) — planned.
- Encrypting contact metadata (name, company, phone) at rest — under consideration.
- Distributed rate limiting for multi-instance deployments — planned if we scale horizontally.
Report a vulnerability
Found a security issue? Please disclose it responsibly by emailing [email protected]. Include steps to reproduce and the impact if known. We take all reports seriously and aim to respond within 48 hours. Please do not publicly disclose issues before we have had a chance to fix them.