Draft — under legal review. Not yet in effect.
Security
A plain description of how Corom protects our Customers’ records, and what it does not do yet. We would rather you know both.
Getting in
- Every page, file and data address of the Service needs a sign-in, except this page, the other policy pages and the sign-in form. Without one, the Service answers “Not found” and shows nothing.
- People sign in either with a shared site access code that the Customer controls, or by name with their email address and a password of their own.
- Passwords are stored only as salted one-way hashes (scrypt). Nobody, including us, can read a password back.
- After five wrong tries in 15 minutes from one network address, or for one email address, sign-in is paused there for 15 minutes, even with the right code.
- New named users set their own password from a one-time link that stops working once used, and after 7 days.
Staying signed in
- Signed-in sessions are kept in cookies that scripts on the page cannot read. They hold an expiry time and a signature, and the Service checks the signature on every request.
- Sessions end after 30 days with the access code. For a person’s own account they end 12 hours after last use, and after 14 days at most. Changing the access code signs everyone out at once. Switching off a person, or changing their password, ends their sessions at once, and people can end their other sessions from their settings.
- A change sent from another website is refused, even from a signed-in browser.
Keeping records honest
- Weigh events are never edited or deleted. A mistake is voided with a name and a reason, and the original stays listed.
- Each change to a record is written in full or not at all, so a failure partway through leaves nothing half-saved.
- Records keep who entered them and how: from the scale, keyed by hand or captured on a phone.
- Each Customer’s owners and admins can see a security log of sign-ins, wrong tries, pauses and account changes for their own people.
Where data lives
- The Service runs on Vercel and its records and uploaded files are kept in a Postgres database run by Supabase, both in the United States (the AWS us-east-1 region). This is the same for US and UK Customers. They are the only outside services that hold Customer data; see Subprocessors.
- The Service is served over HTTPS, so information is encrypted on its way between your browser and the Service.
- Text in uploaded files is read on the Service’s own servers. No outside reading, AI or analytics service sees it.
- No advertising, analytics or tracking code is loaded, and the Service asks search engines not to list any of its pages.
What we do not have yet
- No independent security audit or certification. We do not claim SOC 2, ISO 27001 or any similar certification.
- No two-factor sign-in and no single sign-on.
- People who use the shared site access code are not identified by name, so the Service cannot say which of them did what. Named sign-in can.
- Deleting all of a Customer’s data is done by us on request, not yet from a button in the Service. (A Customer’s owner can already download all of its data from the admin console.)
If something goes wrong
If we confirm that a Customer’s data has been accessed or changed without authorization, we tell that Customer without undue delay, and no later than 72 hours after we confirm it, as our Terms of Service describe.
Reporting a weakness
If you believe you have found a security problem, please tell us at the Contact page. Please give us a reasonable time to fix it before telling anyone else, and do not access or keep other people’s data while looking into it.