Security at Closeout
Your clients trust you with their settlements.
We protect that trust at every layer of the system. Here's what's in place today, and what we're building toward next.
Today
What's in place today.
Data protection
Encrypted at rest, encrypted in transit.
- All stored data and uploaded documents encrypted at rest with AES-256.
- All traffic between client and server protected by TLS 1.2+.
- Document storage in encrypted S3 buckets, scoped per firm.
Identity & access
Right people, right scope, no exceptions.
- JWT-based authentication with short-lived access tokens and rotating refresh tokens.
- Role-based access control: Firm Admin, Attorney, and Case Manager roles with distinct permissions.
- Passwords hashed with bcrypt. Account lockout on repeated failed attempts.
Tenant isolation
Your firm's data never touches another firm's.
- Every query scoped by firmId. Enforced in application code on every read and write.
- PostgreSQL Row-Level Security policies on every tenant-scoped table — enforced at the database layer, not just the app.
- FORCE ROW LEVEL SECURITY enabled: even the database owner must obey the isolation policy.
Audit & compliance
Every action, accounted for.
- Every mutation logged with actor, timestamp, IP, and full diff. Defensible record under ABA Rule 1.15.
- Document handling and storage aligned with HIPAA controls for protected health information.
- Signed Data Processing Agreements with every sub-processor.
Roadmap
What we're working toward.
We don't claim what we don't have. These are the controls actively in motion.
In progress
SOC 2 Type II
Built to SOC 2 standards from day one. Audit engagement underway. Status and current trust report available under NDA.
On the roadmap
SSO + MFA
SAML SSO and TOTP-based multi-factor authentication for firm users. Enterprise tier first; available across plans as the work lands.
Responsible disclosure
Found something? Tell us.
Email security@usecloseout.com with details. We acknowledge within one business day and keep you updated through resolution.