Legal
Security
Last updated 3 September 2026 · Aventura Virtual Solutions Inc. (Canada), operating CloseRev
You're uploading your customers' contact details and revenue. Here's exactly how that's protected — and, just as importantly, what we haven't done yet.
How your data is protected
- Encrypted in transit and at rest. TLS 1.2+ everywhere; storage encrypted at the platform layer.
- Workspace isolation. Every record carries a workspace identifier and every query is scoped to it, including the endpoints that act on a single record — so a guessed identifier from one account cannot reach another's data.
- Password handling. Passwords are hashed with PBKDF2-HMAC-SHA256 at 600,000 iterations (current OWASP guidance), each with its own random salt, and are never stored or logged in any recoverable form. Verification is constant-time. We enforce a 10-character minimum.
- Two-factor authentication. Three options: passkeys (Face ID, Touch ID, Windows Hello or a hardware key), an authenticator app, or a code emailed to you. Passkeys are the strongest and the only phishing-resistant one, because the signature is bound to closerev.com. Emailed codes are the weakest — anyone who reaches your mailbox reaches the code — and we say so where you turn them on. Single-use recovery codes cover a lost device. Once any factor is on it applies to every way into the account, including "Sign in with Google": a second sign-in route is not a way around it.
- Sessions. Opaque, expiring tokens in httpOnly, Secure, SameSite cookies, revocable server-side. Changing your password invalidates every other session immediately.
- Email links. Verification and reset links are single-use and expiring, and we store only a SHA-256 hash of each token — a database leak wouldn't yield working links.
- Payments. Card details go directly to Stripe and never reach our servers, keeping us out of scope for handling card data.
- Audit log. Uploads, matches, review overrides, exports and deletions are recorded per workspace.
- Real deletion. Deleting an import removes its records, its match results and the original uploaded file from storage — not just a row flag.
Data minimisation
Matching needs a phone number or an email address, and an amount. You choose which columns to map, and we'd rather you uploaded fewer. Special-category data is out of scope entirely — see the Acceptable Use Policy.
What we have not done yet
We would rather say this plainly than let a trust page imply more than is true:
- No SOC 2 or ISO 27001 certification. We're an early-stage product and haven't been through an audit.
- No third-party penetration test yet. Planned before general availability.
- No customer-configurable data residency. Storage region is currently platform-default.
If any of these is a blocker for your procurement process, tell us — it's useful for us to know which one to do first.
Reporting a vulnerability
Email security@closerev.com. Please don't access data that isn't yours, and give us reasonable time to fix an issue before disclosing it. We won't pursue researchers acting in good faith.