Encrypted transport enforced
The production site uses HTTPS and sends a long-lived Strict-Transport-Security header on secure responses.
Trust Center
Controls
17 published controls, with status language that distinguishes the current website from customer-specific deployment design.
Content reviewed August 3, 2026Website infrastructure
Hosting, encrypted delivery, and enquiry storage used by the current Coryntas website.
Implemented
Website hosting and delivery
Vercel hosts and delivers the public website and its deployed website functions.
Business enquiry storage
The Console backend saves each business enquiry and its internal email job together in PostgreSQL before confirming receipt.
Form and application security
Safeguards applied to public form submissions and the supporting API.
Registered submission origins
The enquiry API accepts registered Coryntas website origins. Partner applications are checked against the configured site origin.
Automated abuse detection
Business enquiries use self-hosted ALTCHA challenges verified by Console. Partner applications use Cloudflare Turnstile.
Request validation and size limits
The API normalizes input, validates required fields and enums, and rejects oversized JSON payloads.
Network-derived rate limiting
Console limits enquiries by network address and email using hashed rate-limit keys. Raw network addresses are not stored in enquiry records.
Data and privacy
Current website practices documented in the Coryntas Privacy Statement.
Optional analytics requires consent
Google Analytics 4 is not loaded until a visitor accepts optional analytics.
Public request retention is bounded
Business enquiries and their internal email jobs are removed after 365 days by Console worker maintenance. Business correspondence follows the Privacy Statement.
Short-lived verification challenges
Enquiry verification challenges expire after ten minutes, can be used once, and are removed after expiry by scheduled Console maintenance.
Agent governance
Control patterns Coryntas configures around each customer workflow.
Permission-aware context
Source access and workflow purpose are preserved when retrieving knowledge and live records.
Scoped actions
Tools can be limited by identity, role, system, operation, field, state, threshold, and permitted side effect.
Approval policy
Sensitive, ambiguous, or high-impact decisions follow explicit policy boundaries and evidence requirements.
Execution evidence
Sources, decisions, tool calls, approvals, exceptions, and resulting system state can be recorded for review.
Deployment assurance
Requirements confirmed against the systems, data, operating model, and customer environment in scope.
Hosting boundary review
Hosting, network, storage, and model-provider boundaries are documented for the proposed deployment.
Retention requirements review
Retention and deletion expectations are agreed for the data and records used by the workflow.
Change and evaluation path
Context, tools, policy, prompts, and workflow changes are evaluated before controlled release.