How the data is held.
Last updated: August 8, 2026
CloseDrill stores recordings of your reps' voices and the scores derived from them. This page describes the controls that are actually in place, and is deliberately short, because it only lists things we can point at in the code.
Tenant isolation
Every company’s data is separated at the database level by Postgres row-level security, not by application logic. Policies on the sessions, scores, profiles and company-content tables resolve the caller’s company from their authenticated user id and restrict every read to that company. A query that tried to reach another company’s rows returns nothing rather than being filtered after the fact.
Within a company, a rep sees their own drills; leadership sees the company’s. That boundary is also RLS, not a UI check.
Practice is walled off from assessment
Drills a rep starts themselves are private to that rep and never appear on a manager surface. Only drills from an assignment created by leadership, where the scenario and difficulty are fixed server-side, are visible to leadership. The wall is enforced in the database policy, so hiding the UI is not what is protecting it.
Voice recordings
Drill audio is stored in a storage bucket that is not publicly readable. It is never served from a durable public URL. When someone entitled to hear a recording requests it, the server checks their entitlement and then issues a signed link that expires after one hour.
Credentials and keys
Authentication is handled by Supabase Auth; passwords are stored hashed by that provider and we never see or store them in plain text. The administrative (service-role) database key is used only inside server-side route handlers and is never included in browser JavaScript. Traffic is encrypted in transit.
Who processes what
- Supabase: database, authentication, recording storage.
- Vercel: application hosting and request logs.
- ElevenLabs: live conversational voice, conversation audio, and speech-to-text.
- OpenRouter and Anthropic: scoring drill transcripts. Transcripts are sent as text; audio is not sent to the scoring model.
- Stripe: subscription payments. We do not receive full card numbers.
What we do not claim
We hold no security certification. There is no SOC 2 report, no ISO 27001 certificate, and no completed third-party penetration test. We have not had an external security audit. If a vendor questionnaire asks for any of those, the honest answer today is no.
We also have not yet published a data retention and destruction schedule. That gap is visible in the privacy policy rather than papered over, and it is the item we would fix first.
Reporting a vulnerability
Email [SECURITY CONTACT EMAIL] with enough detail to reproduce the issue. We will acknowledge within [ACKNOWLEDGEMENT WINDOW]. Please give us a reasonable period to fix it before disclosing publicly. We do not currently run a paid bug bounty, and we will not pretend otherwise.
Everything else: the contact page. Related documents are indexed at /legal.