Security overview

The short version

• All traffic is TLS; strict security headers (CSP, HSTS, frame-deny) on every response.
• Org data is fully isolated — every query is scoped to your organization.
• Passwords are salted-scrypt hashed; sessions are httpOnly cookies; API keys and reset tokens are stored only as SHA-256 hashes and shown once.
• Rate limiting everywhere it matters: login attempts, signups, public uploads, the free checker, and the API (per-day and per-minute).
• Uploads are validated by content (PDF magic bytes), size-capped, and stored under random names — user filenames never touch the filesystem.
• Certificates are processed as untrusted input end to end; compliance verdicts come from a deterministic rules engine, never from instructions inside a document.
• Nightly backups with 14-day retention; full activity audit log per organization.
• Application containers run as a non-root user with all Linux capabilities dropped.

Email and integrations

Gmail intake uses OAuth through Google's consent screen — CoverWarden never sees your password, and you can revoke access in Settings or your Google account at any time. Outbound email is sent through an authenticated provider with SPF/DKIM alignment.

Reporting

Found something? Email coi@vcorp.co with details — security reports get priority handling.