Security & Responsible Disclosure
Last updated: August 13, 2026
This page describes how we approach access control in Closer OS and how to reach us about a suspected issue. It is our own statement, not a third-party assessment.
Access control
Every app route behind sign-in requires an authenticated session, and database access rules scope records to the signed-in account and its workspace. Signed-out visitors cannot read application data.
Authentication
Sign-in supports email and password or Google. Passwords are handled by our authentication provider and are never stored in the app database in readable form. New email accounts are confirmed by email before first sign-in.
Data in transit
All traffic between your browser and our services is served over HTTPS.
Reporting a vulnerability
If you believe you have found a security issue, email support@example.com with steps to reproduce and hold off on public disclosure until we have had a chance to respond. We will acknowledge the report and keep you updated on the fix. Please do not access other users' data, run destructive tests, or run load or denial-of-service tests against production.