Security & Privacy

How We Protect Your Data

Casino Closer is built from the ground up with data security as a core principle. Here is exactly how your sales call data is handled at every step.

Data Flow & Processing

1Import
When you paste a Fathom share link, our server fetches the transcript directly from Fathom's servers over an encrypted HTTPS connection. The transcript is processed entirely server-side and is never exposed to the browser in its original, unredacted form.
2AI Analysis
The transcript is sent to an AI model via an encrypted API connection for analysis. The AI identifies sensitive information including names, company details, pricing, contact information, and proprietary terms. The AI processes the data in real-time and does not store or retain your transcript data after the analysis is complete.
3Automatic Purge

Once the AI has produced the redacted transcript and performance summary, the original unredacted transcript is automatically deleted from our database. Only the redacted version — with all sensitive information removed — is retained. This happens automatically with no manual intervention required.

The original recording title (e.g., "Call with John Smith at Acme Corp") is retained solely as an internal identifier so you can recognize your recordings in your dashboard. It is never exposed on public shareable links — the public page always displays a redacted version of the title with names and companies replaced.

4Review & Publish
Before any shareable link goes live, you review the AI's redaction decisions. You can remove incorrectly flagged segments or confirm the redactions are complete. Nothing is published until you explicitly approve it.

Video Handling

Video is never downloaded or stored on our servers. The video streams directly from Fathom's content delivery network through a secure proxy. Our server acts as a pass-through only — video data flows in real-time and is never written to disk or saved in any database.

During playback on shareable links, the video player applies real-time redaction overlays: audio is muted and a visual overlay is displayed during segments that contain sensitive information. The original video file is never modified.

Security Measures

Encryption in Transit

All data transfers use TLS/HTTPS encryption. This includes connections between your browser and our server, our server and Fathom, and our server and the AI service.

Automatic Data Purge

Original unredacted transcripts are automatically deleted from the database immediately after AI processing completes. Only redacted content persists.

Cryptographic Share Links

Shareable links use cryptographically random tokens (24 characters, ~143 bits of entropy). Links cannot be guessed or enumerated.

Optional Password Protection

You can set a password on any shareable link during the review step. Passwords are hashed using bcrypt before storage — we never store plaintext passwords. Viewers must enter the correct password before accessing the recording.

Link Expiration

You can set an expiration period on shareable links (7 to 90 days). After the expiration date, the link automatically stops working and viewers see an "expired" message. This prevents forgotten links from remaining accessible indefinitely.

Rate Limiting

API endpoints are protected by rate limiting to prevent abuse, brute-force attacks, and unauthorized bulk data access.

Security Headers

HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy headers are enforced on all responses to protect against common web attacks.

No Video Storage

Video content is never stored on our servers. It streams through a proxy in real-time and is never written to disk, S3, or any database.

CRM Integration Security

Deal Flow Tracker connects to your CRM (HubSpot, Close, GoHighLevel) to automatically sync your deals. Here is exactly how that connection works and what data we access.

OAuth Authentication

We use industry-standard OAuth 2.0 to connect to your CRM. You authorize access by logging into your CRM directly on their website — we never see or store your CRM password. Your CRM issues a limited-scope access token that we use to read your deals.

Read-Only Access

We request the minimum permissions possible — read-only access to deals and opportunities. We cannot create, edit, or delete anything in your CRM. We cannot access company settings, admin controls, billing information, or other users' data.

What We Access

• Deal/opportunity names

• Deal amounts and stages

• Close dates and status

• Contact and company names on deals

• Your CRM account name (for display)

What We Don't Access

• Your CRM password

• Other reps' deals or data

• Company-wide settings or admin controls

• Billing or payment information

• Email content or communication logs

• Any write/edit/delete permissions

Token Security & Disconnect

OAuth tokens are stored encrypted in our database and automatically refreshed when they expire. You can disconnect your CRM at any time from the CRM Integrations page — this immediately revokes our access and deletes the stored tokens. Your previously synced deals remain in your Deal Flow dashboard but no new data will be pulled.

Call Intelligence Data

Call Intelligence analyzes your redacted transcripts to extract objections, sentiment, talk-time ratio, close attempts, and key moments. Here is how that analysis data is handled.

Analysis Runs on Redacted Data Only

Call Intelligence never sees your original transcript. It only processes the redacted version — after all names, companies, pricing, and sensitive data have already been removed by CloserShield. The AI cannot recover or reverse-engineer any redacted information.

What Call Intelligence Stores

Analysis results are stored in your account and include: overall sentiment score, talk-time ratio, energy level, close attempt count, detected objections (type and outcome), key moment timestamps, and topic tags. All of this is derived from the already-redacted transcript.

AI Search Privacy

When you use AI Chat Search to ask questions across your transcripts, your query is sent to the AI along with relevant redacted transcript excerpts. The AI processes your question in real-time and does not retain your queries or transcript data after responding.

What We Store vs. What We Don't

Stored (Redacted Only)

• Redacted transcript (sensitive info removed)

• AI performance summary (uses redacted data)

• Redaction segment timestamps and categories

• Redacted recording title (for public links)

• Original recording title (internal identifier only, never shown publicly)

• Recording metadata (duration, date, source)

• Call Intelligence analysis (sentiment, talk ratio, objections — from redacted data)

• Reference to Fathom video stream URL

• Password hash (if password protection is enabled)

Never Stored / Auto-Purged

• Original unredacted transcript (auto-purged after AI processing)

• Video files (streamed in real-time, never saved)

• Customer/prospect personal information

• Pricing or financial details

• Proprietary company information

• Plaintext passwords (only bcrypt hashes are stored)

Questions about our security practices? We're committed to transparency. If you need additional security documentation or have specific compliance requirements, please reach out to our team.

Back to Casino Closer