Sicherheit

This is an English translation. If it differs from the Spanish version, the Spanish version prevails.

How we protect Coraula

This page summarises Coraula's security measures, by category. It describes how things work today. Customers have the detail of how each measure is applied in the "Detailed security measures" document, inside app.coraula.com. Anyone with an account can read it, as soon as they create it and before contracting anything.

What CRUD commits to with each customer is in its contract: the General Terms of Service and the Data Processing Annex.

Each customer's data, kept apart

Each organisation's data is isolated from the others'. The platform is built so that no query mixes data from different customers, not even for statistics.

Each part only accesses what it needs

Coraula is divided into several parts (the website, the management application, the student portals, administration) and each one has only the permissions it needs. The part the public sees works with reduced permissions. CRUD staff access with their own accounts and only to what they need for their work.

Access and sessions

• Passwords are stored transformed so that they cannot be read.
• Two-step verification, with a code app, can be turned on.
• Sign-in attempts are logged and limited, to stop people guessing passwords.
• Sessions are protected and close by themselves after a period without activity.

Encryption

• Everything travelling between your browser and Coraula is encrypted (HTTPS).
• The keys, service passwords and other secrets the platform stores are kept encrypted.
• Proof of acceptance and signature of legal documents is stored encrypted.

Protection against abuse

We filter requests, limit their number to stop abuse and, on the most exposed forms, check that whoever uses them is a person and not an automated program.

Documents and recordings

• Private documents are only delivered to those allowed to see them.
• Coraula Live recordings are not public: they are only delivered through signed links valid for a limited time, so no link to a recording works permanently.

Logs

We log sign-ins and relevant administrative and security actions, and keep them for a limited time.

Backups

We undertake to make daily backups of the database and of the files customers upload, and to keep them for at least 30 days (clause 13 of the General Terms). Recordings are not part of the backups.

If something happens

If a security incident affects a customer's data, we tell them without undue delay, within the time limits and with the information set out in their Data Processing Annex, so they can meet their own obligations.

If you find a flaw

If you think you have found a vulnerability, write to legal@crudsoftware.com with the details. Do not run tests that could affect the platform or other people's data. We will reply and thank you for letting us know.

Review

We review these measures when the risks, the technology or the way the service is built change. Each change to this page is published as a new version.