Security

The short version. Your workspace runs on our own servers in EU data centres. Every connection is encrypted, each company's data is kept apart, and the contents of your Vault are encrypted in your browser so we cannot read them (their names and some details are not, and your admin holds a recovery key). We are still putting off-site backups in place and run on one server today; we say so plainly below. Found a problem? Write to security@codingcords.com.

Where your data lives

On dedicated servers we run ourselves at Hetzner in the EU, in ISO 27001-certified data centres: the database, files, mail (Stalwart), meetings (LiveKit) and transcription. The companies that also handle data are on the Subprocessors page.

Encryption

• TLS for every connection to the website, the workspace, the portal, mail apps and meetings.
• Vault. Passwords, notes and secrets are encrypted and decrypted in your browser with keys derived from your master password or passkey. We store only the encrypted items, and keys wrapped by keys we never receive, so we cannot read the contents.
  • What we can see: collection names, the type of each item, environment names, who created or changed an item and when, and passkey names. Don't put secrets in those.
  • Each company has a recovery key, held by its admin, which can open all of the company's collections. Anyone with that key and admin access can read the company's Vault, so keep it safe.
  • If every master password, passkey and the recovery key are lost, nobody can recover the items, including us.
• Meetings and calls are encrypted in transit. They are not end-to-end encrypted, because recording and transcription happen on our servers when you turn them on.

Accounts

Passwords stored as argon2id hashes, passkeys, two-step sign-in with an authenticator app, rate-limited sign-in, a list of signed-in devices you can sign out, and a recovery email kept separate from your work mailbox.

Inside the product

Every record belongs to one company and every request is checked against it. Access to each module is granted per member, and sensitive actions are kept in the audit history.

Operations

Server access by SSH key only, for named staff; a firewall open only to the ports the service needs; secrets in a secrets store, never in code; automated tests of permissions and company separation before every release; monitoring; and regular patching.

What we have not done yet

We would rather you hear it from us:

• Backups. Off-site, encrypted backups with regular restore tests are being set up now. Until they are running, your data sits on one server, and a serious hardware failure could lose recent work. We will update this page when backups are live.
• One server. Everything runs on one server, so a failure there takes the service down until it is fixed. A second server comes later; the SLA waits for it.
• No independent audit yet. We have no SOC 2 or ISO 27001 certificate of our own. Our hosting provider's data centres are certified.

Incidents

We investigate every suspected incident, contain it, and tell affected customers without undue delay, and within 48 hours of becoming aware of a breach of their data, as our DPA promises.

Report a vulnerability

See Responsible Disclosure, or write to security@codingcords.com.