Security
What we enforce, and what we do not have yet
Every claim on this page names the place in our codebase where it is enforced, so you can check it rather than take our word for it. The things we do not have are listed first.
- Enforced properties
- 10
- Stated absences
- 7
- Third-party certifications
- 0
We publish absences on purpose. A vendor security review will find them anyway, and a certifications page with no certifications on it tells you more about how we handle inconvenient facts than a page of badges would. When an item below moves from absent to enforced, it moves because an auditor said so, not because we rewrote this sentence.
Data handling
How the site and the browser tools treat your data in the build that is actually deployed.
- Enforced
Image Studio keeps browser evidence local and gates server analysis
Pixel evidence and evidence exports are read in your browser. The separate server-analysis path is behind an explicit build flag and shared OIDC authentication, so a public build cannot enable the gateway without both gates. Service authentication, owner isolation, and deletion are release-tested separately.
Enforced at: src/features/studio/api.ts:12 (enabled === rawEnabled === "true", explicit build boundary)
- Enforced
No third-party JavaScript
The live content policy permits scripts from this origin only, and the deploy refuses to complete if that directive has changed. No tag managers, no embedded widgets, no vendor SDKs.
Enforced at: scripts/deploy-hk.sh (verify_security_headers asserts script-src 'self' on the live policy)
- Enforced
No analytics, no tracking, no advertising pixels
The live policy allows outbound connections to this origin and one newsletter endpoint, and nothing else. There is no behavioural analytics product on this site, so there is no visitor profile to request, export, or leak.
Enforced at: scripts/deploy-hk.sh (verify_security_headers asserts the newsletter connect-src allowlist)
- Enforced
The site cannot be framed by anyone
Frame ancestors are set to none, which blocks clickjacking by embedding our pages inside another site.
Enforced at: scripts/deploy-hk.sh (verify_security_headers asserts frame-ancestors 'none')
- Enforced
Forms submit only to an allowlisted destination
The content policy keeps application forms on this origin. When OIDC is enabled, the only additional form target is the trusted auth.coreidea.cn issuer for its standards-based logout POST.
Enforced at: scripts/deploy-hk.sh (verify_security_headers asserts form-action for the selected auth mode)
- Enforced
No individual's name is published
Registry identity beyond the company itself is released in a diligence pack, not on a public page. An automated check fails the build if a personal name appears in rendered text.
Enforced at: src/data/entity.ts header rule, enforced by scripts/smoke.mjs
- Enforced
No invented customer names
Where we have no customer we may publicly name, the slot reads as unannounced rather than being filled with a plausible logo. This is a rule in the data file, not an editorial preference.
Enforced at: src/data/customers.ts header rule ("NEVER invent customer names")
- Enforced
Every published figure is bound to its source
Each number on this site is registered against the file it derives from, and the build fails if a figure loses its source or is hardcoded a second time somewhere else.
Enforced at: src/data/factRegister.ts + scripts/check-fact-provenance.mjs
Assurance artifacts we do not have
None of the following exists today. If your procurement process requires any of them, we are not yet a candidate, and we would rather you learn that here than in week six.
- Not yet
ISO/IEC 27001 certification
Not held, and no certification is in progress. Any future certificate will be published with its registration number so you can verify it at the issuing body rather than trusting a badge image.
Enforced at: coordination/BUYER_DECISION_GAPS_R18.md item 2
- Not yet
SOC 2 report
No Type I or Type II report exists. We will not describe an internal control review as an equivalent.
Enforced at: coordination/BUYER_DECISION_GAPS_R18.md item 2
- Not yet
Third-party penetration test
No external test has been commissioned. Our own testing is extensive but it is our own, and that distinction is the entire value of an external test.
Enforced at: coordination/BUYER_DECISION_GAPS_R18.md item 2
- Not yet
Published subprocessor list
Not published. The public site's own outbound surface is narrow by policy, but a complete subprocessor register for the platform products does not yet exist.
Enforced at: coordination/BUYER_DECISION_GAPS_R18.md item 3
- Not yet
Standard data processing agreement
No standard DPA is available for download. Data processing terms are handled per contract, which does not scale and is not a substitute.
Enforced at: coordination/BUYER_DECISION_GAPS_R18.md item 3
- Not yet
Data residency statement
We have not published where platform customer data would be stored or how Chinese data legislation applies to it. For a Shenzhen-registered company selling compliance tooling across borders, this is the most important gap on this page and it is unresolved.
Enforced at: coordination/BUYER_DECISION_GAPS_R18.md item 3
Identity you can verify independently
Facts about this company that you can check in a public registry without contacting us.
- Not yet
Public security filing number
Not yet issued. The footer states that it is pending rather than omitting the line, and we will not display a number before the authority issues one.
Enforced at: src/data/compliance.ts publicSecurityNumber is null pending 公安局 issuance
- Enforced
ICP filing number
Our filing number appears in the site footer and links to the Ministry of Industry and Information Technology's public lookup, where it resolves to the registered company.
Enforced at: src/data/compliance.ts (icpNumber, verifiable at beian.miit.gov.cn)
- Enforced
Registered legal entity
The contracting entity's registered Chinese and English names are published and used consistently across the site, including in structured data.
Enforced at: src/data/entity.ts (legalNameZh / legalNameEn, rendered on 10 surfaces)
Reporting a vulnerability
If you find a security issue in this site or in any Coreidea platform, email us with enough detail to reproduce it. We will confirm receipt, tell you what we found, and credit you if you want to be credited. We do not operate a bug bounty and we will not pretend a nonexistent programme exists.
info@coreidea.cn