Security at CoreShield
CoreShield AI is a privacy product. Security is not a feature bolted on — it is the architecture. Here is how we protect the data you trust us with, and how to reach us if you find a flaw.
How your data is protected
Encryption in transit and at rest
TLS 1.3 on every external connection and Istio mTLS between internal services. Vault payloads are sealed with AES-256-GCM using envelope encryption via Vault Transit.
Strong authentication
Passwords are hashed with Argon2id. Access tokens are RS256 JWTs signed with rotating keys, and every account can enforce MFA via TOTP or WebAuthn.
Tenant isolation by construction
Every business table enforces PostgreSQL Row-Level Security keyed to the tenant. Cross-tenant access is impossible by design, not by convention.
Tamper-evident audit trail
Every mutation, AI call, and vault read is written to a hash-chained, HMAC-signed, insert-only audit log. Records cannot be altered or deleted after the fact.
Policy-gated AI calls
An OPA policy engine authorizes every step of the Detect → Cloak → Send → Restore pipeline. No document reaches an external model without passing policy.
Workload identity
Services authenticate to one another with SPIFFE workload identities over mutual TLS, so only known workloads can join the mesh.
Reporting a vulnerability
Found a security issue? Please do not open a public issue. Email us with a description, impact assessment, and reproduction steps, and we will work with you on a coordinated disclosure.
security@maincore.sa- We acknowledge every report within 24 hours.
- We return a triage decision within 72 hours.
- We ask for 90 days of coordinated disclosure before public write-ups.
- Reports in Arabic are welcome at the same address.
In scope
All CoreShield services, applications, packages, infrastructure manifests, and the deployed platform at app.coreshield.dev.
Out of scope
Social engineering, physical attacks, denial-of-service and volumetric testing, and third-party providers (report those to them directly).