Security practices, reporting channels and current assurance status for CoorDay.
Effective May 14, 2026
CoorDay is built with least-privilege access, encrypted transport, audit logging, transactional sync, tombstones and account security controls.
Report vulnerabilities to security@coorday.com.
Controls
Transport uses HTTPS/WSS. Passwords and secrets are stored using approved server-side hashing or secret storage controls.
The product supports passkeys/WebAuthn handoff, TOTP, sessions/devices management, backup codes and account deletion cooling-off controls where enabled.
CoorDay sync applies typed deltas transactionally and tracks cursors to reduce data loss during offline or reconnect flows.
Incident handling
Security events are triaged by severity, logged, and escalated to affected users or regulators when legally required.
We may temporarily disable features, integrations, accounts or providers while investigating abuse or active risk.
Assurance roadmap
SOC 2 and ISO 27001 are not yet certified. The control evidence scaffold is being prepared for future external assessment.
Production readiness depends on completed provider configuration, app store security setup and legal review before broad launch.
