Security

What Cord does to protect your data and your customers’, with the level of detail a security team asks for.

This page describes controls that exist in the product today. If your team needs something that isn’t here, write to us.

Data in transit and at rest

All traffic goes over HTTPS. Cord sends Strict-Transport-Security with includeSubDomains and preload, a content security policy and X-Content-Type-Options: nosniff.
The secrets Cord stores on your behalf (integration credentials, webhook signing secrets) are encrypted with AES-256-GCM before they reach the database. The encryption key can be rotated without losing what was encrypted with the previous one.
Passwords are stored with Argon2id. Session tokens and API keys are stored only as hashes: someone reading the database would not get a usable credential.

Where the data lives and who stamps invoices

Database: PostgreSQL on Neon, AWS region us-east-1 (Virginia, United States).
Compute: functions run on Vercel, region iad1 (Washington D.C., United States).
Invoicing in Mexico: CFDI 4.0 stamping is done by Facturapi as the PAC, with each business’s CSD. Cord cancels CFDIs with their SAT reason and issues credit sales with the PPD method. For each MXN payment on a PPD invoice, Cord automatically stamps its payment receipt complement (type P CFDI), idempotent per payment.
Invoicing in Spain: Cord generates the chained Verifactu records and submits them to the AEAT, separately from issuing, with each business’s certificate (in beta). Without a certificate, the invoice is issued as a pro forma.
Certifications: Cord has no SOC 2 or ISO 27001 today. See security audits.

Identity and access

Sign-in with password, Google or passkeys, and SAML SSO for teams. Apple is coming soon.
A new password has at least 10 characters, does not contain the account email and does not appear in public data breaches. That check uses k-anonymity: only the first 5 characters of the password’s SHA-1 hash leave Cord and the comparison happens in Cord, so the password never travels.
Two-step verification (TOTP). The organization can require it for the whole team and set a maximum idle time.
Sensitive actions (changing the payout account or payout identity details) require signing in again.
Roles per team member, and allowed domains for invitations.

Isolation between organizations

Every query on an organization’s data runs in a context that declares which organization it works for, and an automated check in CI blocks adding a query outside that context. Public links (quote, invoice, mobile capture) resolve the organization with a token and then query inside that same context: the token never grants access on its own.

API

Keys are shown once and stored as hashes.
Three kinds: secret, restricted per resource and publishable. Secret and restricted keys accept a list of allowed IPs, can expire and are rolled with a grace period.
A Secret Key arriving from a browser is rejected. Publishable keys can only use a fixed list of routes and, in live mode, only from the domains you registered.
Rate limits per key and per IP, and Idempotency-Key to retry without duplicates.

Webhooks

Every event is signed with HMAC-SHA256 over the body and a timestamp (X-Cord-Signature-V1), so your server can reject altered or replayed events. The SDKs check the signature and its age for you.
Cord only delivers to https:// URLs on public hosts, never to internal addresses.

Embedded quote (Cord Elements)

The quote lives in a Cord iframe with its own origin: your page can’t read or modify it, and Cord can’t read your page.
Only the domains you register can frame it. With no registered domains it renders read-only, without approve, sign or pay, and without sending data to the host page.
Custom styles go through a validator with closed lists: it accepts no external URLs and no rules that hide or cover content.

Payments

Card details are captured by the payment processor’s form on its own domain. Cord never receives or stores the card number.

Identity verification for payouts

ID photos are checked on the device before they are sent, and their metadata (including GPS location) is removed, keeping only the orientation.
The link to take the photo from a phone is bound to the first device that uses it, has an attempt cap and is never recorded in analytics.

Audit log

Creating, editing, rolling and revoking keys, organization security changes, payments and other sensitive actions are recorded with who, when, the IP and the browser. Admins review it in Settings › Advanced › Audit log.

Retention

Data	How long it is kept
Webhook delivery history	30 days (failed ones, 90)
Identity capture sessions from a phone	Deleted one hour after they close
Identity verification evidence for payouts	5 years from submission

You can export your organization’s data from Settings and delete your account at any time.

Report a vulnerability

Write to security@flouvia.com. Scope, commitments and safe harbor in Report vulnerabilities; the contact is also in /.well-known/security.txt.