Security

Honest account of how CloseKit protects your data — written for buyers, not auditors.

API authentication: every non-public API endpoint requires your firm's API key (X-API-Key or Authorization: Bearer). Keys are stored only as SHA-256 hashes; firms can only ever see their own clients, closes, and tasks.
Secrets management: credentials and keys are configured via environment variables — nothing is hardcoded, and sample configs ship without real values.
Transport: the service is designed to run behind TLS; we terminate HTTPS at the reverse proxy and never accept credentials over plain HTTP in production.
Payments: checkout and card handling are done by Stripe; card numbers never touch our servers.
Input validation: every endpoint validates and bounds its inputs; malformed requests get a 400, never a stack trace.
Logging: structured logs for operations and security events; no secrets or keys are written to logs. Every workspace state change is also kept in your close audit trail.

We are not SOC 2 certified and have not completed a third-party penetration test. We'll say so plainly until we have.
Single-node data store in v1 — back it up daily. Multi-region replication is a later milestone.
Reminder emails are dispatched through your mailbox or sending provider in v1; CloseKit computes and records the queue.

Email don+closekit@lifeofmorr.com with details. We aim to acknowledge within 2 business days.