Security
Last updated November 10, 2026 · For IT and security reviews
CloseCobra records and analyzes sales calls, so we treat every call as sensitive. Each customer’s data is walled off in the database, stored privately and encrypted, and never used to train AI. This page explains how, in enough detail for an IT review. Questions or a security questionnaire: andrew@closecobra.com.
At a glance
- Separated by account. The database itself only returns a person’s own calls, plus their team’s calls if they are the team’s owner or manager.
- Encrypted. HTTPS (TLS) for everything in transit; data encrypted at rest; calendar, email and CRM sign-ins additionally encrypted with AES-256.
- Two-step login. Available to everyone, and team owners can require it. It’s enforced by the database and servers, not just the app.
- No AI training. Calls and files are never used to train AI models, ours or anyone’s.
- Short retention. Call audio is deleted automatically after 30 days. Deleting a call or an account takes effect immediately.
- No card data. Payments are handled by Stripe; card numbers never touch our servers.
- Hosted in the United States.
Where data is stored
Accounts, call results, recordings and uploaded files are stored with Supabase on AWS in the US East (N. Virginia) region. Our server functions run on Netlify in US East (Ohio). Data is encrypted at rest by those providers and in transit with TLS.
Recordings and uploaded files sit in private storage. When you play a recording, the app gets a link that expires within an hour.
Who can see what
- Reps see only their own calls, recordings, follow-ups and files.
- Team owners and managers see the calls their reps record while on the team. Reps are told this before they join, and calls recorded before joining stay private.
- Other customers can never see your data. This is enforced by row-level security policies on every table and storage bucket, not just by the app’s screens.
- CloseCobra staff: access to production systems is limited to the founder. We look at a customer’s data only to provide support they ask for, to keep the service secure, or when the law requires it.
Keys that can read across accounts are only ever used on our servers and never reach a browser or app.
Sign-in and accounts
- Sign in with a password (stored only as a salted hash) or a one-time code sent by email.
- Two-step login with any authenticator app (Google Authenticator, Microsoft Authenticator, 1Password and others), in Settings → Two-step login. A team owner can require it for everyone on the team; anyone without it is asked to set it up before they can see any data.
- The team page shows which members have two-step login on.
- Removing someone from a team ends their access to the team’s calls immediately.
AI and your data
Call audio is transcribed and analyzed through the OpenAI API. OpenAI does not use data sent through its API to train its models. As we understand OpenAI’s current policy, it may keep API data for up to 30 days to monitor for abuse, then deletes it.
- Only what a call needs is sent: its audio or transcript, and, if you use Resources, a few short passages from your files that match what was discussed.
- Calendar data from Google or Microsoft is never sent to an AI provider.
- Sending email from Gmail or Outlook uses send-only permission (
gmail.send/Mail.Send): CloseCobra can’t read, search or delete anything in a mailbox, and only sends when the rep clicks Send. - Nothing you give CloseCobra is used to train AI models.
Retention and deletion
- Call audio: deleted automatically 30 days after the call.
- Transcripts, summaries and follow-ups: kept while the account is open, deletable at any time.
- Deleting a call removes its recording and results. Deleting an account (Settings → Delete account) removes everything immediately, cancels billing and disconnects calendars.
- Export your data any time from Settings → Your data.
- Stripe keeps payment records it must keep by law.
Application security
- Every page sends strict browser security headers: a Content Security Policy that only allows our own code and named services, HTTPS-only (HSTS), no framing by other sites, and no camera or location access.
- Calendar connections use OAuth with the narrowest scopes that work: CloseCobra can only create and change the follow-up events it adds, and the tokens are encrypted with AES-256.
- Payment and phone webhooks are verified by signature, and sign-in codes and team invite links expire.
The Chrome extension
The extension records only when you press Start recording. It captures the tab you choose and your microphone, and nothing else: it doesn’t read your browsing history or the content of web pages. Its Chrome permissions are tabCapture and activeTab (to record the tab you pick), offscreen (to record in the background), storage, alarms and notifications. It only talks to closecobra.com and our database.
Extension ID: dlhflncekaonikieahaemmkpmpdgkmag
Services we use (subprocessors)
| Provider | What for | Data it handles | Location |
|---|---|---|---|
| Supabase | Database, file storage, sign-in | Accounts, calls, recordings, files | US |
| Netlify | Website and server functions | Requests passing through and short-term logs | US |
| OpenAI | Transcription and analysis | Call audio and text sent for processing | US |
| Stripe | Payments | Billing details and card data | US |
| Resend | Sending emails | Email address and email content (reminders, invites) | US |
| Twilio | Dialer add-on only | Phone numbers and call audio for dialer calls | US |
| Calendar sync and Gmail sending (if connected); website analytics | Follow-up events you create; follow-up emails you send; website visits (never call content) | US | |
| Microsoft | Outlook calendar sync and sending (if connected) | Follow-up events you create; follow-up emails you send | US |
| HubSpot, Pipedrive | CRM sync (only if you connect one) | Call summaries, next steps, follow-up tasks and sent emails, logged on the matching contact; we read that contact’s open deal and recent notes | Your CRM account |
CRM and webhook integrations
Connecting HubSpot or Pipedrive uses their standard OAuth sign-in; the access tokens are encrypted with AES-256 and can be revoked by disconnecting in Settings or in the CRM. Audio and full transcripts are never sent to a CRM. If you add a webhook (for Zapier, Make or n8n), CloseCobra sends call summaries to the HTTPS address you enter, signed with HMAC-SHA256 so the receiver can verify them.
For IT teams
If your network filters websites, allow these so CloseCobra works:
closecobra.com(website, app and server functions)nbnahdilcmehjingidnd.supabase.co(database, storage and sign-in, over HTTPS and secure WebSockets)cdn.jsdelivr.net(the database’s browser library)- The Chrome extension above, if you manage extensions centrally
We don’t have a SOC 2 report yet. We’re glad to fill in a security questionnaire or sign a data processing agreement: email andrew@closecobra.com.
If something goes wrong
If a security incident affects your data, we’ll tell you without undue delay, say what happened and what we’re doing about it, and meet any notice deadlines the law sets.
Report a security problem
Email andrew@closecobra.com with “Security report” in the subject and the steps to reproduce it. Please give us a chance to fix it before sharing it publicly, and don’t access other people’s data or disrupt the service while testing. We reply within 3 business days. Our security.txt has the same details.
Related: Privacy policy · Terms · Support