Security

Our Commitment

Korala stores and signs sensitive business documents. The sections below describe the controls that protect them.

Data Encryption

In Transit

TLS 1.2 or higher encrypts all traffic between your browser and our servers. We enforce HTTPS on all connections and use modern cipher suites.

At Rest

We encrypt documents and sensitive data at rest, including database backups.

Infrastructure Security

Our infrastructure runs on cloud providers whose data centers carry independent security certifications. We implement:

• Network isolation and firewalls
• Regular security patches and updates
• Intrusion detection and monitoring
• Automated backups with encryption

Authentication & Access Control

We use multiple layers of authentication to protect your account and data:

• Web Application: JWT-based authentication with refresh tokens
• API Access: HMAC signature authentication that proves each request's integrity and origin
• Signer Access: Unique, time-limited tokens for document signers
• Role-Based Access: Organization-level permissions (owner, admin, member)

Document Security

Each document processed through Korala gets:

• Complete Audit Trail: The audit trail records each action on a document with timestamps, IP addresses, and user identification
• Cryptographic Signatures: Korala signs documents with X.509 digital certificates
• RFC 3161 Timestamps: Trusted timestamps from DigiCert's Time Stamp Authority provide non-repudiation and long-term validity
• Certificate of Completion: Completed documents include a detailed record of all signatures and timestamps

Cryptographic Standards

Webhooks Security

Korala signs each webhook delivery with HMAC-SHA256, so you can verify the payload came from Korala and arrived unmodified.

Responsible Disclosure

If you discover a security vulnerability, report it to [email protected]. We investigate valid reports and fix confirmed issues.

Contact Us

For security-related questions or concerns, contact us at:

Korala LLC
Email: [email protected]