Read-only, scoped, deletable.
What Closeable touches, how it is stored, and how you take it back.
Access model
Closeable only reads from Salesforce, HubSpot and Microsoft Graph. It never writes to your CRM and sends no email on your behalf. Nothing in a mailbox is sent, moved, flagged or marked read.
HubSpot uses a private app token you create with read scopes only, and can revoke at any time. Microsoft 365 uses read-only application permissions (Mail.Read, Calendars.Read, User.Read.All) granted by your admin and bound to your tenant id.
Salesforce uses your own Connected App. Salesforce has no read-only OAuth scope, so the app requests api, refresh_token and offline_access, and Closeable only issues read queries. To enforce read-only on your side, authorize with a user whose profile has read access only.
Mailbox scope
Only mailboxes a manager includes are synced. Removing a mailbox stops its sync and deletes the stored message bodies from it at once.
For tenants that want this enforced by Microsoft rather than trusted to Closeable, an Exchange Online admin can restrict the app to a mail-enabled security group of the sales team with an Application Access Policy:
New-ApplicationAccessPolicy -AppId <Closeable app id> -PolicyScopeGroupId sales-team@yourdomain.com -AccessRight RestrictAccess -Description "Closeable: sales mailboxes only"Closeable then shows any mailbox outside the policy as not accessible.
Data handled
| Data | Source | Stored | Retention |
|---|---|---|---|
| Deals, accounts, contacts, owners, field history, notes, tasks, logged calls | Your CRM | Yes | While the workspace exists |
| Mail headers: sender, recipients, subject, a 255-character preview, time | Microsoft 365 | Yes | While the workspace exists |
| Mail bodies, only for messages matched to a deal | Microsoft 365 | Encrypted | 90 days, then deleted |
| Calendar events: subject, time, attendees | Microsoft 365 | Yes | While the workspace exists |
| Website visits: page, referrer, time, a salted hash of the IP address | Your website, if you add the script | Yes | 180 days, then deleted |
| Scores, signals, reasons, weekly snapshots | Derived by Closeable | Yes | While the workspace exists |
| Model outputs: extracted signals and written reasons | Derived by Closeable | Yes | While the workspace exists |
Attachments, Teams messages and chat are never read.
Encryption
TLS in transit. Mail bodies and connection credentials are encrypted at rest with AES-256-GCM using a server-side key, in addition to the database provider's disk encryption. Credentials are never returned to the browser.
Tenancy
Every read and write checks workspace membership on the server. Managers see only their own workspace. The demo workspace is isolated and reset nightly.
Model usage
Deal evidence is sent to Anthropic's API to extract signals and write the reasons for a score. Only the matched evidence for one deal is sent per call. Under Anthropic's commercial API terms, your data is not used to train models. The numeric score itself is computed by Closeable from the signals, and the outputs are stored with the deal and shown in full.
Deletion
Disconnecting a connection stops syncs and deletes its credentials at once. Disconnecting Microsoft 365 also deletes the stored mail bodies at once.
Deleting a workspace deletes all workspace data within 24 hours. A written request to support@closeable.com is honored within 7 days.
Subprocessors
- VercelHosting and marketing site analytics without cookies
- NeonDatabase, United States
- AnthropicModel API for signals and reasons
- ResendEmail delivery: sign-in links, invitations, the Monday review
- StripeBilling
- MicrosoftSign-in and Graph, your own Microsoft 365 tenant
No IP-to-company reveal vendors. Website matching uses reverse DNS and network ownership records only.
Reporting a concern
Report a security concern to security@closeable.com.