How we protect the data you share with us.
In one page.

Everything an enterprise procurement, security, or compliance team needs to evaluate CORE — concentrated in a single page instead of scattered across five PDFs.

Active
Zero Retention Policy
TLS 1.3 · AES-256
Encryption in transit & at rest
SSO / SAML
Enterprise authentication
In Progress
SOC 2 Type II audit

Zero Retention — the single most important thing to know

Nothing you share with CORE — your business requirements, uploaded documents, existing code, or the software CORE generates — is ever used to train, fine-tune, or improve any AI model. Ever.

Your data stays inside your project's boundary. Access is limited to systems that directly serve your build. When your engagement ends, your data is deleted according to a documented retention schedule. What CORE builds for you is yours alone — permanently.

Security built into every layer

CORE's security posture is defence-in-depth, not perimeter-only. Each layer has its own controls, monitored independently.

🔐
Encryption
All data encrypted in transit and at rest using industry-standard cryptography.
  • TLS 1.3 for data in transit (TLS 1.2 minimum for legacy clients)
  • AES-256 for data at rest
  • Envelope encryption with regular key rotation
  • Secrets managed via dedicated secret management systems (never in code, config, or logs)
👤
Access & Authentication
Least-privilege access with enterprise SSO integration.
  • SAML 2.0 / OIDC single sign-on (Okta, Azure AD, Google Workspace)
  • Multi-factor authentication enforced for administrative access
  • Role-based access controls with segregation of duties
  • All administrative actions logged with immutable audit trails
📋
Audit & Logging
Complete, immutable audit trails for compliance and forensics.
  • Append-only audit logs across data-affecting operations
  • Configurable retention (typical: 7 years for SOX-scope data)
  • Log integrity monitoring against tampering
  • Access logs available for customer-side review
🛡
Application Security
Applications generated by CORE incorporate OWASP-aligned protections by default.
  • Input validation and output encoding
  • SQL-injection, XSS, and CSRF mitigations built in
  • Rate limiting and abuse prevention
  • Prompt injection defence at AI layer
🌐
Infrastructure
Hosted on enterprise-grade cloud infrastructure with configurable data residency.
  • Deployed on major cloud providers (AWS, Azure, GCP) at customer choice
  • Configurable data residency (US, EU, UK, APAC)
  • Cloudflare edge protection (bot mitigation, DDoS)
  • Automated backups with tested restoration
🚨
Incident Response
Documented incident response with defined SLAs.
  • 24-hour customer notification for confirmed security incidents affecting them
  • Documented containment, eradication, and recovery playbooks
  • Post-incident review and customer-facing report
  • Responsible disclosure programme via report@ssdbtech.com

Compliance frameworks CORE aligns with

CORE's controls are designed to satisfy — or generate applications that satisfy — the requirements of the following frameworks. Formal certifications are progressing; "aligned" means our design and controls meet the framework's requirements, "certified" indicates completed third-party audit.

SOC 2
TYPE II
SOC 2 Type II
Audit in progress · Q3 2026
ISO
27001
ISO 27001
Controls aligned
NIST
800-53
NIST 800-53
Controls aligned
GDPR
DPDP
GDPR & DPDP
Data protection compliant
HIPAA
HIPAA
Applicable controls built-in
OWASP
OWASP Top 10
Mitigations by default
SOX
SOX (§404)
Audit-trail generation
PCI
DSS
PCI DSS
Applicable controls available

Responsible disclosure

Security researchers and customers who identify a potential vulnerability can report it confidentially to report@ssdbtech.com. We respond within 48 hours and follow a documented triage and remediation process.

Detailed policy documents: Security Policy · Privacy Policy · Acceptable Use Policy

Need something specific for your evaluation?

Compliance questionnaire, DPA request, penetration test report, subprocessor list — we're set up to respond.

Request security documentation →