Security

Where your data lives

There are three ways to use ClosePack and they behave differently. Which one you are in decides what reaches us.

This website

The interactive demo and the tie-out on this site run on fixed sample data in your browser. There is nothing here to open: no file picker, no drop target, and no save feature. The numbers are built into the page. The only thing you can deliberately submit is the early-access form. Our servers, our error reporting and our page-view analytics also record things you never typed, such as your IP address, your browser, and which pages you opened, and our Privacy Policy itemises all of it.

Two things on this site reach Google, and they are different in kind. If you accept analytics on the bar at the foot of the page, each page sends a page view to Google Analytics, which then sets its own cookies; we run it with advertising signals switched off, and if you decline, nothing on this site is sent to it. The home page also carries a teaser hosted on YouTube: nothing is requested from the video host until you press play, and pressing play connects you to it directly, under its own terms. The Cookie Policy says exactly what each of them receives.

The studio, without an account

Signed out, the studio is a sandbox. It opens a sample company on its own and every surface works, but there is no way to open a file of yours anywhere in it: import needs an account. None of your numbers can reach us from the sandbox, because there is no way to enter them. The things every web request carries, like your IP address, are covered above and in the Privacy Policy.

What you change there is kept in your browser’s own local storage, so a refresh does not lose your work, and while you are signed out nothing you build is written to our servers. That copy stays on your machine and clearing your browser data removes it.

The signed-in product

An account is where your own numbers live, starting with the transaction list you import. Reading that file and turning it into statements happens entirely in your browser: the parse itself uploads nothing. Your work is saved to your private, access-controlled workspace as you go, and the product tells you on screen when a save has not gone through, so you are never left believing something was kept when it was not. There is no separate save step. How that workspace is protected is described below.

Encryption in transit

This site and the product are served over HTTPS, so traffic between you and ClosePack is encrypted in transit.

Isolation for signed-in data

Work saved in the signed-in product is stored in a Postgres database with row-level security, so each account can only read and write its own data. We follow least-privilege practices for the access our own systems have to that data.

Who we rely on

The providers that process data on our behalf are the same ones named in our Privacy Policy, each under its own terms:

• Supabase hosts the Postgres database and the sign-in service behind the signed-in product. Row-level security is enforced there.
• Vercel hosts and serves this site and the product, and terminates the HTTPS connection. Every request passes through it, so its server logs carry request metadata.
• Google Analytics receives traffic measurement from the marketing site only, and only from visitors who accepted analytics: pages opened, and ordinary interactions with them. It runs with advertising signals switched off, and it is not loaded by the signed-in product, so it never sees a workspace, a ledger, or a session.
• Sentry receives error and performance reports so we can find and fix failures. Session replay is switched off in both applications, so it never records your screen.

Scope

ClosePack is the reporting layer. It does not move money, connect to bank accounts, or initiate transactions. It reads the numbers you bring and helps you present them.

Reporting a vulnerability

If you believe you have found a security issue, please tell us at hello@closepack.io and give us a reasonable chance to address it before any public disclosure. We appreciate responsible reports.