Encrypted transport enforced
The production site uses HTTPS and sends a long-lived Strict-Transport-Security header on secure responses.
Trust Center
Controls
17 published controls, with status language that distinguishes the current website from customer-specific deployment design.
Content reviewed August 3, 2026Website infrastructure
Controls observable in the current coryntas.com website and delivery worker.
Implemented
Browser security headers applied
Responses apply content type, framing, referrer, permissions, and cross-origin protections.
Content Security Policy defined
The website restricts scripts, frames, connections, images, forms, and object sources to the services it uses.
Form and application security
Safeguards applied to public form submissions and the supporting API.
Same-origin submission checks
API requests are rejected when their origin does not match the configured Coryntas site origin.
Automated abuse detection
Cloudflare Turnstile verifies public form submissions outside local preview environments.
Request validation and size limits
The API normalizes input, validates required fields and enums, and rejects oversized JSON payloads.
Network-derived rate limiting
Public submissions are rate limited using salted, time-bounded hashes rather than storing raw network addresses in request records.
Data and privacy
Current website practices documented in the Coryntas Privacy Statement.
Optional analytics requires consent
Google Analytics 4 is not loaded until a visitor accepts optional analytics.
Public request retention is bounded
Demo and security-information requests that do not become customer records are retained for up to 12 months.
Short-lived rate-limit records
Scheduled cleanup removes expired rate-limit records after their limited protection window.
Agent governance
Control patterns Coryntas configures around each customer workflow.
Permission-aware context
Source access and workflow purpose are preserved when retrieving knowledge and live records.
Scoped actions
Tools can be limited by identity, role, system, operation, field, state, threshold, and permitted side effect.
Approval policy
Sensitive, ambiguous, or high-impact decisions can be routed to the accountable human authority.
Execution evidence
Sources, decisions, tool calls, approvals, exceptions, and resulting system state can be recorded for review.
Deployment assurance
Requirements confirmed against the systems, data, operating model, and customer environment in scope.
Hosting boundary review
Hosting, network, storage, and model-provider boundaries are documented for the proposed deployment.
Retention requirements review
Retention and deletion expectations are agreed for the data and records used by the workflow.
Change and evaluation path
Context, tools, policy, prompts, and workflow changes are evaluated before controlled release.