Security & Data

Specific controls, not security theatre.

We describe substantiated practices and facts still requiring production verification.

Data hosting and subprocessors

Our current suppliers and where they hold data are listed in section 6 of the privacy notice. We publish region details only as far as we have verified them.

The transfer safeguards KVKK requires for these suppliers are not in place yet. Request the current position at hello@coleoid.systems before sending sensitive information.

Authentication and access

Accounts use verified email and managed sessions.
Organization access is role-controlled.
Failed sign-in protection stores an HMAC-derived key rather than raw addresses.
Password reset links are stored hashed, expire after 30 minutes, and end every session on success.
Invitations use hashed single-use tokens that lapse after seven days.
Administrative access follows least-privilege principles.

The audit trail

Every change to roles, processes, and relationships is recorded in one append-only history, so the organization holds a record of what changed and who changed it. That log is not yet exposed as a customer-facing report.

Analytics and session recording

Coleoid measures use in two tiers. Anonymous visit counts and speed measurements carry no identifier and can be switched off. Identified analytics and masked session recordings run only after you allow them.

Sentry captures error reports automatically in the browser and on the server: error details, browser and device information, the page address reduced to its route, and the page changes and requests leading up to the error, with performance traces and their timings sampled from about one in ten page loads and page changes. They are kept in Sentry's EU region in Frankfurt. Console output and screen recordings are never sent, and server reports carry no request data (cookies, headers, IP address or body) and hide database query values. PostHog's automatic exception capture is off. Recordings hide all text and inputs, exclude request bodies, headers and console logs, and never run on People Operations pages.

Data isolation

Organizational records carry an organization identifier and access is role-controlled; strict organization isolation is not claimed pending audit.

Incidents and vulnerability reporting

Suspected incidents are investigated, contained, and documented. Report vulnerabilities to hello@coleoid.systems without credentials, tokens, or unnecessary personal data.

Certifications

Coleoid is not currently SOC 2 or ISO 27001 certified.