Skip to main content
For AI agents: a documentation index is available at https://docs.coverbase.com/llms.txt — this page is also available in markdown by appending .md to the URL.
Your vendor data, assessment evidence, and contracts are protected in transit and at rest, isolated to your organization, and held only as long as you need it.

​
Encryption

In transit

All connections use TLS 1.2 or higher, with certificates from recognized authorities. There is no unencrypted surface — the API, the dashboard, and the MCP server are HTTPS only.

At rest

Customer data is encrypted at rest in our managed data stores and object storage using industry-standard algorithms.

​
Tenant isolation

Coverbase is multi-tenant, and isolation between tenants is enforced in depth rather than at a single boundary.
  • Every record is org-scoped. Each object carries the ID of its owning organization, and that scope is enforced at the data-access layer on every read and write — not only at the API edge.
  • Credentials are single-org. An API key authenticates to exactly one organization; everything it reads or writes is implicitly scoped to that org. A request can never reach another tenant’s data by changing an ID. See API conventions.
  • AI access inherits the boundary. MCP tool calls run with the connected user’s permissions and cannot escalate beyond what that user could do in the UI. See MCP permissions.
A resource ID that does not belong to your organization is treated as not found (404) — the same response as an ID that does not exist — so existence in another tenant is never leaked.

​
Key and secret management

Application secrets and credentials are stored in a managed secrets service (AWS Secrets Manager), not in source code or configuration files. Secrets are never committed to source control, and access to them is restricted and logged.

​
Network controls

Organizations can lock down where API access is allowed to originate from.

API IP allowlist

Restrict all public-API (ak_... key) requests to a set of IPv4/IPv6 CIDRs. The control is fail-closed and uses the unspoofable load-balancer-provided client IP. See API IP allowlist.

​
Data residency

Customer data is hosted on managed cloud infrastructure. For specific data-residency requirements, contact security@coverbase.ai to discuss your needs.

​
Retention and deletion

  • Retention. We retain customer data for the life of your subscription and the period defined in your agreement and our privacy policy.
  • Deletion. On contract termination, customer data is deleted in line with the agreed terms. You can also delete or archive records yourself through the dashboard and API throughout the engagement.
  • Backups. Deleted data ages out of backups according to the backup-retention schedule.

Privacy policy

See the Coverbase Privacy Policy for how we handle personal data, including data-subject requests.