This is a translation provided for convenience. The French version prevails in case of discrepancy.

Security

Last updated October 22, 2026.

Your proposals hold prices, terms and sometimes sensitive details about your customers. This page says how Clozer protects them, and also what it does not do yet. For a security questionnaire or a specific question: contact@clozer.club.

Where your data lives

• Application hosted by Vercel, Paris region.
• Database at Neon, Frankfurt region.
• Documents and recordings stored by Vercel, Paris region.
• Emails sent by Amazon Web Services, Stockholm region.

Outside the European Union: the AI providers (Anthropic, OpenAI) receive the text of documents to read them and draft follow-ups, without the readers' email or IP address, and do not train their models on it. The full list, with each provider's country and safeguards, is on the subprocessors page.

Encryption

• All traffic goes over HTTPS (TLS), enforced by the browser through HSTS.
• Database and files encrypted at rest with AES-256 by our hosting providers.
• Secrets you give us (Slack webhook, your webhooks' signing key, Google tokens) are also encrypted by the application, with AES-256-GCM.
• Tokens of the Chrome extension and the Outlook add-in are only stored as a hash.

Your documents and links

• PDFs are stored with private access. No public address of the file exists: it goes through our servers, which check on every opening that the link is active, not expired, not withdrawn, and that the email was given if you asked for it.
• Documents are neither cached nor indexed by search engines.
• Each link carries a random 12-character identifier (about 71 bits): it cannot be guessed or enumerated.
• Withdrawing a link or letting it expire cuts access at once, forwarded copies included.
• Every uploaded file is checked: a real PDF, 25 MB at most.

Access and isolation

• Each workspace is isolated: every read and write is filtered by workspace on the server.
• Three roles: owner, admin, member. Deleting a document, exporting or erasing data is for admins; deleting the workspace, for the owner.
• Passwordless sign-in: a link valid for 5 minutes sent by email, or your Google account. 7-day sessions. Repeated attempts are blocked.
• Sensitive actions (team, exports, erasures, deletions, extension sign-in) are written to an audit log, kept for 12 months.

The application

• Security headers (HSTS, protection against framing by other sites, content policy).
• Request limits on public entry points (email form, Smart Link, document opening, uploads, sign-in), against bots and repeated attempts.
• Your webhooks are signed (HMAC SHA-256) and never go to an internal address. Incoming webhooks (Stripe, Amazon) are checked by their signature.
• Dependencies monitored continuously, code analysis (CodeQL) and secret detection on every change.

Personal data

• Readers' IP addresses are never kept in clear, only as a hash.
• Reading data is erased automatically 12 months after a link's last activity; a deleted document is gone for good 30 days later, files included.
• You export or delete your workspace at any time, and answer a prospect's requests (export, erasure) from Settings › Data.
• The reader is told on the page what you see; every follow-up carries an unsubscribe link.

Details are in the privacy policy and the data processing agreement.

Backups and incidents

• The database is backed up continuously by Neon, with point-in-time restore.
• In case of a data breach, we notify the customers concerned no later than 48 hours after becoming aware of it, with what they need for their own notification to the authority.

Certifications

Clozer holds no certification of its own (ISO 27001, SOC 2). Its hosting providers do: Vercel and Neon are ISO 27001 certified and SOC 2 Type 2 audited, as is Amazon Web Services; payments go through Stripe, PCI DSS Level 1 certified. Clozer never sees or stores your card numbers.

What Clozer does not do yet

• The email asked for on opening identifies the reader, it does not verify them: someone who receives the link can open it. Withdrawing the link cuts their access.
• No password or watermark on documents; the reader can download the PDF.
• No two-factor authentication of Clozer's own. With Google sign-in, your Google account's applies.

If one of these matters to you, tell us: that is what sets our priorities.

Reporting a vulnerability

Think you found a vulnerability? Write to contact@clozer.club, without exploiting it beyond what is needed to show it, and without touching other customers' data. We answer within 72 hours and will not pursue research done in good faith.