Security

Effective 3 November 2026 · Version 1.0

What CloseLoop Labs holds

• Your account: name, email address, company name and settings.
• An encrypted key from Google that lets us read and act on your Gmail and Calendar.
• A record of each email we sort (sender, subject, date, the AI's summary and category) and any draft replies. Full email bodies and attachments are read when needed and not stored.
• A short description of your writing style, your business description and your team's addresses.
• An activity log of key actions, such as replies sent and emails moved.

Hosting and infrastructure

The app runs on Vercel, in its London region. Your account and records are stored in a Supabase Postgres database. Both are established cloud providers with independent security certifications. The full list of providers is on our Legal page.

Data location and international transfers

The app runs in the UK. Some providers, including our AI provider, Anthropic, are based in the United States. Where data leaves the UK, it's protected by UK adequacy regulations or the UK International Data Transfer Addendum. See section 6 of our Privacy Policy.

Encryption

• In transit: every connection, to you, Google, our database and our AI provider, uses HTTPS (TLS).
• At rest: our database and hosting providers encrypt stored data.
• Your Google key: encrypted by us with AES-256-GCM before it reaches the database, using a key kept separately from the data.

Availability

CloseLoop Labs is in early access. We aim to keep it running around the clock, but we don't offer an uptime guarantee or service credits yet. If a brief can't be sent, Settings > Morning brief shows what went wrong.

Access control and account isolation

• You sign in with Google, so we never store a password for you, and Google's 2-step verification protects your account.
• Every request is checked against your signed-in session, and every database query is limited to your own account.
• The database can't be reached from browsers at all: row-level security blocks public access, and only our server holds the key.
• We ask Google only for the access the features need, and you can revoke it in Settings or your Google account at any time.
• Only the owner of CloseLoop Labs has administrator access, and only looks at your data if you ask for support or it's needed for security.

Built-in safeguards

• Nothing is sent from your account until you click Approve & send, and you can undo for 10 seconds.
• Drafts with unfilled [placeholders] can't be sent.
• Email is only ever moved to Gmail's Bin, never permanently deleted.
• The AI treats every email as untrusted and ignores instructions written inside emails.

AI processing

To sort, summarise and draft, we send the relevant email text to Anthropic's Claude API. Under Anthropic's commercial terms, API data isn't used to train its models, and we never use your data to train AI models either.

Data retention and deletion

You can delete your sorted emails, drafts and writing-style profile at any time from Settings > Connected accounts, or delete your whole account from Settings > Privacy & data, which removes everything straight away. See section 7 of our Privacy Policy.

Incident response

We monitor errors and unusual activity. If a personal data breach affects you, we'll tell you without undue delay, and report it to the Information Commissioner's Office within 72 hours where the law requires.

Reporting a vulnerability

If you think you've found a security issue, email security@closelooplabs.io with the details. Please give us a reasonable chance to fix it before telling anyone else, and don't access other people's data while testing. We'll reply as quickly as we can.

Other policies: Terms of Service · Privacy Policy · Cookie Policy · Legal