Data Protection & Isolation

• Encryption in transit - All communications are secured using TLS/HTTPS.
• Encryption at rest - Data stored in AWS RDS (PostgreSQL) and AWS S3 is encrypted at rest using AWS server-side encryption.
• Organization isolation - Organization membership is validated on every API request. All database queries are scoped by organization ID. Cross-organization access returns 403 and is logged.
• Application-enforced tenant isolation - Organization (tenant) data boundaries are enforced in the application layer, with every request validated and scoped to the user's organization.
• Data residency - Documents and records are stored within AWS (S3 and RDS) in the EU region. Some platform functions use third-party processors: AI assistance, when enabled, is processed via Anthropic's commercial API, and the web application is delivered through our hosting provider. Document and file storage is not shared with other third-party services.

Access Control

• Role-based access control - 8 defined roles govern what each user can view, create, review, and approve within the platform.
• Separation of duty - In multi-user governance configurations, the user who submits a record cannot be the same user who approves it. Organizations may also operate in self-governed (single-user) configurations, in which separation of duties is not enforced.
• Session management - Sessions are managed with configurable timeout policies.
• Multi-factor authentication - MFA support is available for user accounts.

Audit & Traceability

• Append-only audit trail - All governance actions are logged with the acting user, timestamp, and details of the change.
• Version history - Every model record maintains a full version history, preserving all prior states.
• Chronological event chain - Events are recorded in sequence, enabling forensic reconstruction of any governance workflow.

AI Behavior & Isolation

• Stateless per request - AI requests do not persist context on our servers between requests. Each request carries only the data needed to fulfill it; where a feature is conversational, the conversation context is supplied with the request and is not retained server-side after the response.
• No cross-user influence - One user's data cannot appear in, or influence, another user's AI output. Each request contains only the requesting user's organization-scoped data.
• Non-training - No customer data is used to train AI models. CoreID uses Anthropic's commercial API, which explicitly does not use request data for model training.
• Assistive only - AI features support governance workflows but do not make decisions. All AI outputs require human review and do not replace organizational accountability.
• Organization-level control - AI assistance can be disabled entirely at the organization level. When disabled, no data is sent to external AI services.

Infrastructure & Storage

• Cloud hosting - Core data is stored in Amazon Web Services (AWS), EU region (Frankfurt). The web application is delivered through our hosting provider, and AI assistance, when enabled, is processed via Anthropic's commercial API.
• Database - PostgreSQL managed via AWS RDS; tenant isolation is enforced in the application layer.
• File storage - Documents stored in AWS S3 with cryptographically signed pre-signed URLs. Access URLs are short-lived (typically 60 seconds to 1 hour depending on document type) and scoped to the exact file path. Path traversal protections prevent directory access attacks.
• Rate limiting - Rate limiting is applied to protected endpoints to prevent abuse, with Redis-backed enforcement and in-memory fallback.

Testing & Validation

• Adversarial testing - The platform is tested under simulated attack conditions, including permission-escalation attempts, hostile input payloads, and cross-organization data-access probes.
• Authentication coverage - Authentication enforcement is routinely tested across platform APIs and protected routes.
• AI trust boundary - AI integration is tested for prompt injection, invalid output handling, and hallucination. AI-suggested values are validated against the platform schema before use, and the system is designed to reject injected instructions.

Compliance Positioning

Security Inquiries

For security-related questions or concerns, please contact: