Skip to content
ClosedEasy

Trust

Security & privacy

Your clients are trusting you with the biggest purchase of their lives. Here's exactly how ClosedEasy protects them — in plain English. For the legal detail, see our Privacy Policy.

Private documents

  • Uploaded documents are stored in private storage and never get a public link.
  • Every download checks, on our server, that the person is the deal's agent or a client on that deal.
  • A client only sees documents the agent shared plus their own uploads — never another client's uploads on the same deal.
  • Downloads are sent as attachments with strict headers, so a file can't run code in your browser.

Accounts & access

  • The whole site is HTTPS-only, enforced with HSTS.
  • Passwords are stored as salted hashes — never in plain text — and resetting a password signs out every other session.
  • Sign-up, password reset and sign-in codes are guarded by an invisible bot check and limits on repeated tries, and are refused from the Tor network, so our emails can't be turned against someone else's inbox.
  • Optional two-step sign-in: with it on, signing in with a password, or an emailed or texted code, also asks for a code from an authenticator app (or a single-use backup code). Its secret and backup codes are stored encrypted, and you're emailed whenever it's turned on or off.
  • Settings → Sign-in & security lists every browser signed in to your account, with Sign out for each one and Sign out everywhere else.
  • Changing your sign-in email takes your password (or a fresh emailed code) and a link opened from the new inbox. Nothing changes until then; the old address is told, and your other devices are signed out.
  • Invite links are long random tokens. An invite addressed to an email address only opens for someone who proves that inbox with a code we email to it (or, for a client, a code texted to the mobile on the invite), so a forwarded link can't be used by anyone else. Agents can replace or revoke any link instantly.
  • Removing a client from a deal cuts their access immediately.

Emailing documents to a deal

  • Each deal's email address is a long random code, and the agent can replace it at any time.
  • An email goes straight in only when it's from someone on the deal's team or its saved lender, escrow or other agent — and their email provider confirms they really sent it (SPF/DKIM/DMARC). Anything else waits for the agent to accept it.
  • Emailed-in documents are hidden from clients until the agent shares them, and only the usual document types are kept — no programs, web pages or SVG images.
  • No AI reads these emails.
  • Signing status only counts emails from the signing services' own domains that pass their email authentication (DMARC) — a look-alike waits for the agent. Nothing is checked off on its own, and clients see a signing only when the agent shows it.

Team chat alerts

  • A channel's webhook link is stored encrypted (AES-256-GCM), never shown again, and deleted the moment you disconnect.
  • We only ever post to the exact Slack, Microsoft Teams, Google Chat or Discord webhook address you pasted — https only, no redirects followed — after a test message proves it works.
  • Posts are one short line with a link back; nothing a client types can ping your whole channel. If the service says the link is gone, posting stops and you're told once.

Connected CRMs

  • A CRM key (e.g. Follow Up Boss) is stored encrypted (AES-256-GCM), is never shown again after it's pasted, and is deleted the moment you disconnect.
  • We send your clients' name, email, the phone number you typed and (buyers) the property address, and each deal's address, price, key dates and stage as a deal record — never changing your contacts' existing details.
  • Changes you make in your CRM come back only as suggestions you review; nothing in ClosedEasy, or anything your clients see, changes on its own.

Payments

  • Payments are processed by Stripe. Card numbers go straight to Stripe — we never see or store them.
  • Clients never pay anything.

The AI assistant

  • A client's assistant only sees that client's deal: the steps, dates, updates and document names shared with them. It never sees the agent's internal steps, other clients' files or questions, or any other deal.
  • Answers are written by Anthropic's Claude models through Anthropic's commercial API.
  • It doesn't give legal, tax or financial advice, and it won't turn outside web links into buttons — so a planted message can't steer a client to a fake payment page.
  • Agents can read every question their clients ask it.

Wire-fraud protection

  • Whenever a deposit or closing-funds step is open, the client's board shows a persistent warning: never wire money based on an email or text — call a verified number first.
  • When the agent records the escrow contact on that step, the warning includes a tap-to-call button for that number.
  • When the lender or escrow officer posts progress through their update link, clients only ever see ClosedEasy's own fixed wording — never text the partner typed — so a forwarded or stolen link can't send clients wiring instructions. "Closing figures ready" always carries the call-first warning, and the agent can turn a link off at once.

Your data

  • We use deal data only to run the service — we never sell it, and we don't send marketing texts.
  • Agents can permanently delete a deal and its documents; anyone can delete their account from Settings. An agent's past deals with clients on them go with the account, after Settings offers a download of the records.
  • Other questions about your data? Email support@closedeasy.com — we read every message.

Report a vulnerability

  • Email support@closedeasy.com with “Security report” in the subject, what you found and the steps to reproduce it.
  • We confirm we have it within one business day and keep you posted until it's fixed.
  • Test only with accounts and deals you own. Don't access other people's data, disrupt the service or send spam, and give us a fair chance to fix the problem before you share it.
  • We won't take legal action over research that follows these rules in good faith.

Also published at /.well-known/security.txt.

ClosedEasy is a client-communication layer, not a legal record, escrow service or compliance system — your broker's system stays the record of the file.