Platform security
The platform runs on providers with SOC 2 Type 2 audits, encrypts data in transit and at rest, and separates each company's information at the database level.
Overview
The data clients upload (assets and their location, management units, vulnerability surveys, assessments and reports) is protected in four layers:
- Certified infrastructure. The database and files are hosted on Supabase; the application runs on Vercel. Both operate under SOC 2 Type 2 controls audited every year by independent third parties.
- Verified identity. Only registered users can sign in, with email and password or with their Google or Microsoft account. Each new company stays pending until Coralia approves it.
- Isolation between companies. Every database query goes through Row Level Security rules: a user can only read and modify their own company's data.
- Controlled changes. No change reaches production without review and approval by the technical lead.
Architecture and data location
Client data is stored on Supabase and the application that processes it runs on Vercel, both in São Paulo, Brazil. Every connection is encrypted over HTTPS.
| Component | Provider | Location |
|---|---|---|
| Database, files and sign-in | Supabase (on AWS) | São Paulo, Brazil |
| Application and server functions | Vercel | São Paulo, Brazil |
| Climate layers and methodology | Supabase Storage (private) | São Paulo, Brazil |
The assessment tool in the browser. The assessment tool runs in the user's browser: while an assessment is being edited, it keeps a working copy in that browser and syncs it with the platform database, where it is available to the company team.
Climate layers. The hazard, projection and enabling-condition layers used by the assessment tool are kept in private storage. They are only delivered to signed-in users, through a signed link that expires after 10 minutes.
Infrastructure: Supabase and Vercel
| Provider | What it does | Certifications | Encryption |
|---|---|---|---|
| Supabase | PostgreSQL database, files and sign-in | SOC 2 Type 2, audited annually | In transit and at rest |
| Vercel | Runs the web application and its server functions | SOC 2 Type 2; ISO 27001 | HTTPS on every connection; encryption at rest |
What each certification covers. SOC 2 Type 2 is a report by an independent auditor that verifies, over a period of time, that security, availability and confidentiality controls work. ISO 27001 certifies the information security management system.
Shared responsibility. Supabase and Vercel protect the infrastructure: servers, network, operating system, backups and monitoring. Coralia is responsible for how the application uses that infrastructure: who has access, to what data and with what permissions.
Access to the platform
- Sign-in. With email and password, or with a corporate Google or Microsoft account. Authentication is handled by Supabase Auth: the platform never stores passwords in readable form.
- Sessions. The session travels in secure cookies and is renewed with short-lived tokens. The assessment tool cannot be opened without a session.
- Approval of new accounts. A company that signs up stays pending until a Coralia consultant approves it. Until then it cannot use the assessment tool, save data or ask Coral-IA.
- Protected plan and approval. Only Coralia can change a company's plan and approval: the database rejects any attempt to change them from the client's account.
- Coralia consultants. They have a separate role to support clients, approve accounts and handle plan requests, assigned from the server: users cannot grant it to themselves.
| Role | View | Upload and edit | Manage users |
|---|---|---|---|
| Admin | Yes | Yes | Yes |
| Editor | Yes | Yes | No |
| Viewer | Yes | No | No |
Data isolation between companies
- Row Level Security. Every table with client data has row-level security enabled, with rules that limit each read and write to the user's company.
- Double check. Permissions are checked in the application and, in addition, in the database, which limits every query to the user's company.
- Files. Company logos and assessment-tool layers are kept in storage with access rules; layers are only delivered through a short-lived signed link.
- Server keys. Credentials with full privileges live only on the server, as encrypted environment variables, and never reach the browser.
- Browser protections. The platform sends headers that enforce HTTPS, prevent other sites from showing it inside a frame and limit browser access to the camera and microphone.
Artificial intelligence and other providers
Coral-IA, the platform's assistant, uses the Anthropic API (Claude). Anthropic does not train models on data sent through the API and deletes it from its systems within 30 days, except content flagged for violating its usage policy. Conversations are stored in the platform database, within the user's company.
| Provider | Purpose | Data it receives |
|---|---|---|
| Supabase | Database, files and sign-in | All platform data |
| Vercel | Running the application | The data in each request while it is processed |
| Anthropic | Coral-IA assistant | The questions the user asks and the context of the screen they are on |
| Google and Microsoft | Corporate sign-in, if the user chooses it | Account name and email |
| Resend | Sending email notices (for example, a new account notice to the Coralia team) | Name, email and phone of the person signing up and the company name |
Secure development and change management
- Protected main branch. Every change goes through a pull request that the technical lead reviews and approves.
- Traceable deployments. Every published version is recorded with its author and date.
- Production isolated from development. Changes are tested in a local preview, without real client data.
- Versioned database changes. Every change to the structure or access rules is a numbered migration reviewed together with the code.
- Secrets out of the code. Keys and credentials live in encrypted environment variables, never in the repository.
Backups and continuity
- Backups. The database is hosted on Supabase, with an automatic backup every week.
- A copy of your assessments. Assessments are stored on the platform. If the company needs a copy, it can request one at contacto@coraliae.com and we will send it.
- Availability. Vercel publishes every version immutably: if a new version fails, the previous one can be restored in minutes.
- Incident response. If an incident compromises a client's data, Coralia notifies the affected company without undue delay, with its scope and the measures taken. To report a security issue: seguridad@coraliae.com.