Trust
Where the data lives, who can touch it, and which certifications we hold today. We would rather show you an empty box than a badge we have not earned, because you are going to check.
What is in force today.
Controls you can read, and in several cases check yourself from inside the product.
Stored and processed in eu-central-1. The sub-processor list is published, and it is short.
You see the request before deciding, you can refuse it, you can end a live session, and you can read every screen we looked at from your own audit trail.
Row-level security on every tenant table, forced rather than merely enabled, and fail-closed. Isolation under simultaneous load is measured on our own hardware rather than asserted.
GDPR erasure runs in the product and returns a receipt naming what was retained and the legal basis for keeping it. Article 15 access is assembled by hand today; the automated surface is not finished, and we would rather say so.
On a paid plan, figures, lineage and the audit trail export as CSV and XLSX and your report PDFs are yours. The free tier keeps full lineage on screen but not the export.
Every action in our AWS account is logged by CloudTrail with tamper-evident log files, kept 400 days. Root use, sign-in without MFA, permission and firewall changes raise an alarm, and GuardDuty watches for threats. Staff actions in the product write to a hash-chained trail.
The database is dumped every night to encrypted, versioned storage in Frankfurt and kept 35 days. Once a month the newest dump is restored into a scratch database and compared with production; the first restore, on 2 October 2026, matched in every table.
Update permission on the report table is revoked at the database, and that revocation came back intact from a local restore drill. The managed-database rehearsal is still owed.
Certification status
Stated one line each, with no roadmap language standing in for a certificate.
Submitted to the Cloud Security Alliance STAR Registry on 3 October 2026 and awaiting CSA’s review. A self-assessment is not a certification: it publishes our answers to the 138 questions of the CAIQ-Lite v4.1.0, including the seven we answer No, for anyone to read. We will link the listing here when CSA publishes it.
Not yet certified, and not yet started. It is budgeted for after the first paying customers, and no certification body has been approached. The day an engagement is signed we will name the body and the stage here. Until a certificate is issued we will not display a mark, because you are going to check.
Not held and not started. If you need SOC 2 today, we are not the right vendor yet, and we would rather say so than gesture at a roadmap.
Budgeted and briefed, not yet commissioned: no practitioner is engaged and no date is set. Until one has reviewed the calculation methodology, we call the output ready, not audited.
Not yet performed, and no provider has been engaged. It is budgeted for the first paying customers, from a CERT-In empanelled tester; when it is commissioned we will publish the scope and the date here, followed by a summary of findings and fixes. Until then the security artefact we can point at is a dependency allowlist with zero entries, which is a fact rather than a claim.
Report a vulnerability
If you have found a security problem in CoreCanopy, write to security@corecanopy.earth. We acknowledge within three working days, we will not take legal action against good-faith research that follows our policy, and we will tell you when it is fixed. The contact is also published in our security.txt.
The vulnerability disclosure policy
Written policies
Eleven security and privacy policies, approved in October 2026 and reviewed every year: information security, access control, change management, incident response, backup and continuity, logging and monitoring, data classification and retention, vendor and sub-processor management, cryptography and key management, workspace and endpoint security, and interoperability and portability. They are written from what we actually do. Customers and prospective customers can request them from security@corecanopy.earth.
Data residency
Customer data is stored and processed in AWS eu-central-1 (Frankfurt). It is not replicated outside the European Union.
One thing we will not paper over: the controller and its operator are in India, and the service is administered remotely from there. We treat that access as a transfer under Chapter V of the GDPR. For data we process on your behalf, it is covered by the EU Standard Contractual Clauses (Module Two) and the UK Addendum in our Data Processing Agreement, which forms part of the terms automatically. The agreement is pending review by counsel, and any change that review makes will be published with its date.
Isolation, measured
Row-level security is enforced on every tenant table, fail-closed, with 60 live policies across 45 tables that are forced rather than merely enabled (counted from the migrations on 2026-09-13). That is the design. The measurement is more useful: under simultaneous two-tenant load across 27,768 requests, tenant A returned a p95 of 237.32 ms against tenant B’s 236.59 ms, 0.3% apart, with zero failures. That run was on our own hardware against a local database, so it is an isolation test rather than a production service level, and we will publish the production figure when there is one. A noisy-neighbour claim with a number behind it is still a different kind of claim.
Support access is consented, refusable and logged
- You see the access request before deciding, with the reason the engineer gave.
- You can refuse. A refusal is recorded as an outcome, not dismissed as a dialog.
- You can end a live session yourself, without asking us.
- Every screen we opened is written to your own audit trail, with the row counts, for you to read afterwards.
- Emergency access is its own permission, held by one role, and writes to the same chain.