How we protect your data

Settlement agencies handle sensitive information about buyers, sellers and borrowers. Closing Desk is built so that only your team can see your files.

Each agency is walled off

Every record is tied to one agency. Access rules enforced inside the database itself, not just in the app, mean a user can only read or change files that belong to an agency they are a member of. These rules are covered by automated tests that run against the real database schema.

Encryption

• All traffic uses HTTPS (TLS), with HTTP Strict Transport Security enabled.
• Data is encrypted at rest by our database host.
• Passwords are never stored in readable form.

Access and accountability

• Two-factor sign-in with an authenticator app. Agencies can require it for every member, and the database itself refuses to release files until the code is entered.
• Owner, admin and member roles. Only owners and admins can invite people, remove people or delete files.
• Invite links work once, only for the invited email address, and expire after 7 days.
• Every change to a file is recorded with the person and time, and the history can’t be edited by users.

What we ask you not to store

Closing Desk is a workflow tracker. Keep Social Security numbers, bank account numbers and wire instructions in your closing software, not here.

Payments

Card payments are processed by Stripe. We never see or store card numbers.

Infrastructure

The app is hosted on Vercel and the database on Supabase, both of which maintain SOC 2 Type II reports. Payments are processed by Stripe, which is PCI DSS Level 1 certified.

Report a concern

Email support@example.com. We aim to respond to security reports within one business day.