Security

What we store

Your account

Your email address, your name and country if you give them, your plan, and your Stripe customer reference. Card details go to Stripe and never reach CorpusReady.

Your uploaded file

The raw CSV or XLSX file, on disk, until the deletion job removes it (see the schedule below). It is never stored in the database.

Your inventory

Record counts, date ranges, field names and types, personal-data flags, and up to three redacted sample values per field.

Your rights answers

Your answers to the rights questions and the green, amber or red flag for each.

Your pack

The de-identified pack, redaction log, manifest and scorecard, until you delete them or close your account.

The audit log

A record of uploads, refusals and deletions (see below).

Where it is

Everything runs on one server that Trove Distribution Limited rents from DigitalOcean in its London data centre. The database, the job queue and the personal-data detection service run on that same server and accept connections from it only. The server’s firewall allows only web traffic and SSH.

How long we keep it

A scheduled job checks every hour, deletes each file that is due and writes the deletion to the audit log. DigitalOcean’s weekly backup of the whole server is also switched on. DigitalOcean keeps each of those backups for four weeks, and a backup can contain a raw upload that was on the server when it was taken.

Encryption

In transit

The app is only served over HTTPS (TLS), with certificates issued automatically by our web server, Caddy. Plain HTTP redirects to HTTPS. Until HTTPS is working on www.corpusready.com, the server shows a holding page and accepts no sign-ups or uploads.

At rest

The server’s disk is not encrypted. DigitalOcean does not encrypt Droplet disks, and we have not added disk encryption of our own. Uploaded files and backups can be read only by the app’s own system account and the server administrator (folder permissions 0700, file permissions 0600).

Who can access it

• Inside the app, each account sees only its own sources and packs. Anything else answers “page not found”.
• The server accepts SSH logins by key only, for one administrator account. Password logins and root logins are switched off. The keys are held by Trove Distribution Limited, for its own administration and deployment tooling.
• No language model receives raw customer data. Detection and redaction are deterministic. No language model is used anywhere in the product today.

Languages

Malay-language text is checked with pattern rules and an English-language model; detection in Malay prose is weaker than in English.

The audit log

The audit log is append-only. It records each upload, each refusal and each raw-file deletion, with the reason for the deletion and a check that the file is gone from disk. When an account is deleted, its audit entries are kept without the link to the account.

What we refuse

CorpusReady refuses these at upload. It detects them, stops, explains why and deletes the file.

• Health data, such as diagnoses, prescriptions, medication or patient records
• Biometric data
• Data about children
• Financial account data, such as card numbers and IBANs
• Government ID numbers, such as Malaysian NRIC, passport, UK National Insurance and US Social Security numbers

Report an issue

If you think you have found a security problem, email hello@corpusready.com with what you found and how to reproduce it. Please do not access other people’s data while testing. See also our privacy policy.