Security & trust
Your reports describe your clients’ weaknesses. Here is how we protect them.
Your own instance
Each customer runs on a dedicated instance with its own database, files, containers and secrets. No shared tenancy.
Encryption and backups
TLS in transit. Stored credentials and secrets are encrypted. Nightly encrypted backups (AES-256-GCM), kept 30 days and 12 months, with a restore test every month.
Access control
Two-factor authentication, role-based permissions checked on every endpoint, and an audit log of sign-ins and changes.
Integrity of what you issue
Issued reports are locked and fingerprinted. Letters can be verified publicly. Library updates are cryptographically signed and checked before import.
Monitoring
Health, backups, certificates and failed sign-ins are checked every 5 minutes, with alerts to our team.
No lock-in
The engine is open source (GPLv3). You can export your data at any time, and our continuity letter covers what happens if Coreclipse stops.
Request the trust pack (security overview, data-residency matrix, DPA draft, questionnaire answers): info@coreclipse.com.