Review Korala’s security controls.

Access and permissions

Korala separates workspace access, API authentication and recipient signing access. Use the controls appropriate to the task and review the permissions you grant.

API requests

API-key authentication uses an HMAC signature for the request. The authentication service checks the signature and key before attaching its organization and environment to the request.

Document completion evidence

At document completion, Korala calculates a SHA-256 hash of the final signed PDF and records the timestamp result for the certificate and audit trail.

After a recipient signs, you may still need to wait for other signatures or final-file preparation.

Signatures, qualified timestamps and test documents

Completed documents carry a PAdES B-LTA signature (ETSI EN 319 142) made with Korala’s platform certificate, RFC 3161 timestamps from an EU-qualified timestamping service, and the certificate and revocation data needed to validate them after those certificates expire.

The platform signature is Korala’s seal on the document. eIDAS does not count it as a qualified electronic signature of the signers. You can check any completed PDF in Adobe Acrobat or the EU DSS validator without a Korala account.

Test documents do not receive trusted timestamps. Check each document’s completion evidence for its timestamp status.

Connected accounts and assistants

Google Docs and Drive

A Google connection belongs to the user who connected it. Importing creates a copy in Korala. Review connected accounts and any optional partner API access in integration settings.

AI assistants

Connect an AI assistant through MCP and review the workspace and permissions you grant. Each signer completes their own signature.

Deployment and data protection

For questions about hosting, data handling or controls relevant to your organization, contact Korala. Review the privacy policy and data processing agreement alongside your requirements.

Report a security issue

If you discover a security vulnerability, contact [email protected]. Use the same address for security-related questions.