Security
Last updated: July 2026
Encryption
All traffic to Corely is encrypted in transit with TLS. Your data is stored in a managed PostgreSQL database with encryption at rest and enforced SSL connections.
Accounts & passwords
Passwords are hashed with bcrypt — never stored in plain text. Repeated failed sign-ins trigger a temporary account lockout, and sign-in attempts are rate-limited to slow brute-force attacks.
Sessions
We use short-lived access tokens plus a rotating refresh token kept in a secure, http-only cookie. Refresh tokens are hashed in our database and rotated on every use, so a stolen token is detected and invalidated.
Workspace isolation
Every workspace's data is isolated. Requests are scoped to your workspace so one business can never read or write another's records.
Auditing
Changes to your data are recorded in an audit log attributed to the user who made them, so you have a trail of who did what.
Payments
Payments are handled by our payment provider (Razorpay). Card details are entered on the provider's secure checkout and are not stored on our servers; we verify each payment cryptographically before activating your plan.
Reporting an issue
Found a vulnerability? We appreciate responsible disclosure — email security@corely.in and we'll respond promptly.