Tenant isolation
Every query runs inside an organisation scope. With no organisation in context it closes to "where 1 = 0" rather than opening: a console job without a tenant reads nothing, instead of reading everything.
Trust
Security you can check.
Every line on this page says which of four things it is: enforced on every request, a setting your organisation controls, off until you switch it on, or not built. We would rather be short than reassuring.
Compliance and frameworks
No badges for things we do not hold. Where something is missing or not yet built, that is what the line says.
eIDAS
Electronic signatures under Article 25: legally valid and admissible as evidence, with a one-time code by email, a document fingerprint, a tamper-evident SHA-256 trail and a completion certificate. We do not call the standard signature advanced — a BankID signature will be, once BankID is switched on — issue no qualified signature (QES) and are not a trust service provider.
GDPR
A data processing agreement, and a sub-processor list published with purpose and region.
Bokföringslagen
SIE4 type 4I against the BAS chart of accounts. No file is written unless the entry balances to zero in öre.
Mervärdesskattelagen
VAT per rate on the invoice, never blended into one figure.
Räntelagen och inkassokostnader
Reminder and collection fees are capped at the statutory 60 and 180 kronor, enforced in settings rather than left as advice. Late-payment interest has no default, because the reference rate is reset twice a year.
BankID
Signing and identification are built, and wait on Closepact’s BankID agreement before they are switched on. Until then BankID is not shown as a tick anywhere on this site.
What holds under every organisation.
Audit log and retention
Who did what, when. Signing events are numbered and chained with SHA-256, so an altered row breaks the chain; the chain is verified every night, and on PostgreSQL the database refuses to change or delete them. You set how long other records are kept in Settings → Security: 365 days by default, 30 at the least and 3 650 at the most.
Two-factor
TOTP with recovery codes. An organisation can require a second factor of every member, and the requirement is checked on each request rather than only in the interface. It is off by default: we do not switch on something that locks your staff out on your behalf.
Addresses and sessions
An organisation can restrict which addresses and CIDR blocks it is reached from, and how long a session may sit idle — 720 minutes by default, between 5 and 1 440. An empty allowlist means "never configured", not "deny everything", and an administrator saving a list without their own address in it is stopped before the save, not after.
Passwords
Mixed case and digits are the floor everywhere and cannot be configured away. Minimum length is set per organisation from 8 to 64 characters, and a symbol can be required. Where an account belongs to several organisations, the strictest one wins — otherwise joining a lax one would be a way to weaken a credential in a strict one.
SSO
Google sign-in where a Google client is configured. SAML 2.0 and SCIM exist in the code but are off by default, and core.sso sits in the roadmap list of the Pro tier — which means it is not part of what you get today. Planned.
AI
AI refuses rather than inventing.
AI is part of the Pro tier of Offert & e-signering and nowhere else, and it only runs where a language model is configured. Where none is, the system answers 503 and refuses to generate. The alternative — falling back on a mock that writes fluent invented prose — is how a business case nobody wrote reaches a buyer.
No AI tier below Pro, and no AI at all without a configured provider.
OpenAI is the provider that is implemented. No other model is wired in.
A monthly cap on AI sessions per organisation, with a meter in the app. Tokens are counted for reporting, not as the limit — a token count is not knowable before the answer comes back.
Each generation is stored against the deal and the person who ran it, and identical input is served from cache rather than sent again.
What happens to the data, said once.
The same three sentences appear in the terms, the privacy policy and the DPA. If you find a fourth version anywhere on this site, it is a mistake and we want to know.
Cancelling a module deletes nothing
The period you paid for runs out, the module is readable for 90 days after that, and then it is archived. Archived closes the door; it does not empty the room. A failed card moves you onto the same path rather than locking you out mid-week.
Deleting an account takes 14 days
You request it in the app with your password. The request is scheduled 14 days ahead and can be withdrawn at any point in between. A nightly job carries out the requests whose 14 days have passed.
Audit records keep the time you set
The default is 365 days; the lowest that can be set is 30 and the highest 3 650. Records past your period are purged — including for an organisation that has already left, because a retention period that only holds while the account is open is not a retention period.
Who else touches the data.
The current list, with what each one is for. Three of them process nothing until they are configured, and the list says which.
| Provider | Purpose | Region |
|---|---|---|
| Hetzner Online | Hosting of the application, the database and storage | DE (EU) |
| Cloudflare | Edge CDN and DDoS mitigation | Global |
| Closepact's own mail server (at Hetzner) | Transactional email: signing invitations, reminders, invoices | DE (EU) |
| OpenAI | AI generation. Only where a provider is configured | US |
| Twilio | SMS. Only where SMS is configured; otherwise nothing is sent | US |
| Stripe | Billing and subscriptions | US / IE |
| Sentry | Error monitoring. Only where a DSN is configured | EU / US |
The full list and the notification policy live at /legal/subprocessors.
The questions that get asked before signing.
Which sub-processors touch our data?
The ones listed at /legal/subprocessors, with purpose and region for each. We notify customers in writing at least 30 days before a new one begins processing, and you may object in writing during that window.
What happens to our data if we cancel a module?
Nothing is deleted by the cancellation. The period you paid for runs out, the module stays readable for 90 days, and then it is archived. A failed card is a billing problem, not a reason to lock somebody out of their own operation mid-week, so it moves onto the same path rather than cutting access on the day.
How do we delete an account?
From the app, confirmed with the account password. The request is scheduled 14 days ahead and can be withdrawn at any time in between; a nightly job carries out the ones whose 14 days have passed. Written requests about personal data go to privacy@closepact.com and are answered within 30 days.
How long is the audit log kept?
For the period your organisation sets in Settings → Security. The default is 365 days, the minimum 30 and the maximum 3 650. A job removes records past that period, including for organisations that have already left — a retention period that only holds while the account is open is not a retention period.
What happens to what we type into the AI feature?
It is sent to the configured provider to generate the answer, and stored with us as a generation against the deal and the person who ran it. Where no provider is configured, nothing is generated at all: the system answers 503 rather than falling back on a mock that writes invented text. AI exists only on the Pro tier of Offert & e-signering.
Can we require two-factor of everybody?
Yes. It is a setting on your organisation and it is enforced on every request, not only in the interface — a switch that is believed and not enforced is worse than no switch. It is off by default because we do not lock your staff out on your behalf.
How do we report a vulnerability?
Email security@closepact.com. We acknowledge within one working day and share a remediation timeline within five. We do not pursue or threaten researchers acting in good faith.
Report a vulnerability.
Found something? Email security@closepact.com . We acknowledge within one working day and share a remediation timeline within five.