Trust & security
What protects your data, and the date we last proved each control. Nothing here measures how exposed we are today: that would help the wrong reader far more than the right one.
Proof, not adjectives
4 of 4 dated controls confirmed within their own cadence, read from the systems that run them.
- 2026-10-26
Encrypted backup, verifiedConfirmedruns nightly
142 tables, 233,783 rows, re-read and decrypted after writing.
- 2026-10-01
Cold archive read backConfirmedruns quarterly
The oldest backup kept, 14 days old, opened in 1.1 s.
- 2026-10-26
Audit log sealedConfirmedruns daily
The record of privileged actions is sealed cryptographically every day, so history cannot be quietly rewritten.
- 2026-10-22
Software bill of materialsConfirmedevery release
CycloneDX 1.5, 727 production components.
AvailabilityMeasured externallytarget 99.5 % a month
Watched by an independent uptime monitor. Live status
We publish when a control last ran — never a live measure of how exposed we are. A control we cannot confirm is shown as such, never dropped.
What we are not, yet
Our controls are built for SOC 2 alignment. No auditor has issued an attestation, and we will not claim one before that happens.
Authentication, email and AI routing are US providers. The database, error monitoring and analytics run in the EU. Each one is listed below.
Detection runs every 30 minutes, day and night. A person answers in office hours, Rome time.
No posture score, no count of open findings, no list of failing checks. Those stay with the people who can act on them.
What we commit to
Each commitment says how you can hold us to it: dated live above, checked automatically before it ships, or written in our policies.
Proven liveChecked automaticallyWritten policy3 proven live · 12 checked automatically · 21 written policy
Data protection & privacy5 commitments
- We keep a record of processing activities (GDPR art. 30). A data-protection role with its own confined access exists; the DPO will be named on this page when appointed.Written policy
- Access, export and deletion of your data are self-service, from your own account.Written policy
- Consent is recorded per purpose, and access to personal data is logged.Written policy
- The database, error monitoring, analytics and rate limiting run in the EU. Authentication, email and AI routing run in the USA.Written policy
- No prompt is sent to an AI provider that keeps or trains on it.Checked automatically
Encryption6 commitments
- All traffic is encrypted in transit over TLS; HTTPS is enforced with HSTS.Written policy
- Data is encrypted at rest by our managed database and storage providers.Written policy
- AES-256-GCM on top of that for second-factor secrets, sign-in tokens and support-mandate reasons; second-factor keys rotate without locking anyone out.Checked automatically
- Daily encrypted off-site backups, read back and decrypted after every write.Proven · 2026-10-26
- Each kind of signed link or seal has its own key — a claim link cannot pass for a mandate seal or an attestation, whatever it carries.Checked automatically
- Secrets never live in the source code: a scanner reads every push and the whole history.Checked automatically
Access control7 commitments
- Role-based access with least privilege; side roles are confined to their section, and an elevated role can carry an end date.Checked automatically
- A second factor (TOTP) can be required for each staff account, and a passkey for each role — the super-admin first.Written policy
- Every admin request passes the same gate, which checks the second factor; sensitive actions ask for a fresh one.Checked automatically
- Staff edit a business’s page only under a time-boxed mandate its owner issues and can revoke; private messages are never delegable.Checked automatically
- A hosted organisation decides any access Corners has to its bureau, code or incident details: one right at a time, time-boxed, with a passkey.Checked automatically
- Offboarding is one action: sessions are cut first, then roles, second factors, devices and mandates.Checked automatically
- Privileged admin actions are recorded in an audit log sealed every day.Proven · 2026-10-26
Application security5 commitments
- A strict per-request Content-Security-Policy: scripts carry a nonce, with no unsafe-inline or unsafe-eval in production. Inline styles are still allowed.Written policy
- Our servers may call only the hosts on a declared list.Checked automatically
- Dependencies are scanned every day and findings go to our security agent; an AI security review runs on proposed changes.Written policy
- OWASP-aligned scans (dependencies and a running-site scan) report findings; a risk we accept is written down with its reason.Written policy
- Untrusted text sent to an AI model is fenced as data, and sensitive routes are rate-limited.Written policy
Infrastructure & availability3 commitments
- Managed Postgres, plus our own encrypted daily backups whose oldest copy is read back every quarter. Recovery objectives: 24 hours of data, 4 hours to restore.Proven · 2026-10-01
- A key rotation is recorded only once the new key has been proven to work.Checked automatically
- A bot challenge protects the public support and report forms.Written policy
Monitoring & incident response5 commitments
- Identity threat detection replays the audit trail every 30 minutes against rules mapped to MITRE ATT&CK, impossible travel included.Checked automatically
- A security sensor (Wazuh) runs outside our hosting, in the EU, and sends signed alerts back — a hosting outage does not blind us.Written policy
- Errors are monitored continuously (Sentry, EU), and a watchdog alerts us when a scheduled safeguard goes silent.Written policy
- Containment is real and recorded: sessions and devices revoked, second factor reset, account suspended.Written policy
- A written incident process with severity levels, and a blameless post-mortem within 48 hours for significant incidents.Written policy
Security governance4 commitments
- Twelve written security policies — access, change, incidents, continuity, vendors, data handling and more.Written policy
- An annual, documented risk assessment, fraud scenarios included, with named controls and the risks we accept written down.Written policy
- A vendor register with criticality tiers and an exit plan for each critical provider.Written policy
- Monthly snapshots of evidence — security posture, backups and audit seals — written once.Written policy
Payments1 commitment
- Corners takes no payment yet. When it does, checkout runs on hosted providers (Stripe, Flutterwave), and no card number reaches Corners.Written policy
Who processes data for us
14 sub-processors, read from the register our data-protection role keeps. One list, never typed twice.
- Hetzner Online GmbHHosting of the Wazuh security VM (operated by Corners)EU (Falkenstein, Germany)
- NeonPrimary database (Postgres)EU (Frankfurt)
- PostHogProduct analytics (consent-gated)EU (Frankfurt)
- SentryError monitoring & masked session replay (debugging/security)EU (Frankfurt)
- UpstashRate-limiting (Redis)EU (Frankfurt)
- CloudflareTurnstile CAPTCHA & image genGlobal edge
Purposes are written as in the register, in English.
Found a security issue?
Write to us — we acknowledge within 72 hours. Please do not disclose it publicly before we have fixed it.
security.txt (RFC 9116) · expires 2027-07-14 · languages en, fr
Documents on request
- Data processing agreementGDPR art. 28
- Security questionnaireanswered by a person
- Software bill of materialsCycloneDX, with its digest
Provided for transparency; not part of any contract. Data processing terms are in our DPA.