Security at CoreInto

Secrets encrypted where they are stored#

Server passwords and API tokens, payment gateway keys, registrar credentials, saved card references, service passwords, domain transfer codes, mailbox passwords, staff two-step seeds, the SMTP password, the reCAPTCHA secret and the licensing signing key are all encrypted in the database with AES-256-GCM. Each value is bound to the place it is stored, so a value copied to another column or another installation does not open there. A copy of the database alone reveals none of them.

Passwords of staff and clients, security answers, session tokens, API secrets and password-reset links are hashed, so they cannot be read back by anyone, including us.

Who can sign in, and how#

• Two-step sign-in with an authenticator app for staff, and for clients who turn it on, with recovery codes.
• Roles decide what each member of staff can see and do, down to single actions such as refunding a payment.
• Lock-outs after repeated failed sign-ins, per address and per account, with the address banned for a while.
• Banned IPs and email domains, and security questions for clients if you use them.
• Sessions listed for each member of staff, with the option to end them.
• API credentials with scopes and expiry dates, so an integration gets only what it needs.

Pages that resist common attacks#

Every form carries a token tied to the session, and admin pages refuse forms posted from other sites. Pages are served with a strict Content Security Policy that forbids inline scripts, so an injected script does not run. Uploaded files are checked by content and stored outside the web root where possible.

Updates you can trust#

Every CoreInto release is signed with a release key kept offline. Your installation downloads an update and installs it only when the signature matches, so a compromised download server cannot push a bad update. Security fixes ship as ordinary releases, available to every plan.

An audit trail#

The activity log records sign-ins, failed sign-ins, changes to settings, refunds and other sensitive actions with the member of staff and the address. The module, gateway and email logs record what CoreInto sent and received, with secrets hidden.

This website#

The coreinto.com sites are served over HTTPS with HSTS, a strict Content Security Policy and no third-party scripts apart from Google reCAPTCHA on forms. The admin area uses Argon2id passwords, two-step codes, a separate cookie and an audit log.

Reporting a security issue#

If you believe you have found a security issue in CoreInto or on our websites, please tell us privately through the security form or at support@coreinto.com, with the version, the steps to reproduce it and what an attacker could do. Please give us a reasonable time to fix it before you publish anything, and do not access data that is not yours or disrupt other people's service while testing. We will confirm receipt within two working days, keep you informed, and credit you in the release notes if you wish.