Security and compliance

This page is for security, risk and compliance reviewers.

Certifications

Topic	What to know
SOC 2 Type II	Coris has a SOC 2 Type II report. Request the report and the pentest report in the Coris trust center.
GDPR	Coris lists GDPR compliance in its trust center. Send privacy questions to [email protected].
Data retention	Coris follows written retention procedures. The trust center has the details.
Deletion on exit	When you leave, Coris deletes your workspace data: accounts, persons, transactions, files, notes and tags.
Continuity	Coris tests its continuity and disaster recovery plans.

How the API is protected

Control	How it works
HTTPS only	The API accepts TLS 1.2 or higher only. Production does not answer plain HTTP.
Separate environments	Sandbox and production have their own hosts, portals, keys and data. A sandbox key gets `401` in production.
Keys from the portal	You create keys in the portal. No API call can create or revoke a key.
Server-side calls	Call Coris only from your server. A key in a web page is open to every visitor.
Signed webhooks	Each webhook is signed with HMAC-SHA256 and that endpoint's secret.
Correlation IDs	Each response has a `Correlation-ID` header. Support uses it to find your request.
Stored secrets	Your Stripe API keys, your Adyen credentials and HMAC key, and the secrets that sign Coris webhooks sit in encrypted fields.
IP allowlisting	Coris does not offer it. A valid key works from any address.

Limit what a key can reach

An admin or developer can create a key that reaches only accounts boarded by named ISOs. For example, a key for one ISO gets 404 on another ISO's merchant, and 403 on routes it cannot use. Ask Coris to turn this on.

Any key, partner-wide or ISO-scoped, can expire after 90 days, 180 days or 1 year, or never. You can revoke any key. To rotate, create a new key, move your traffic, then revoke the old one.

Coris checks the key on every request, so a revoked key fails at once. Coris logs who created and revoked each ISO-scoped key.

What Coris stores

Data	Belongs to
Business data: establishments and legal entities	Coris-sourced data
Accounts, with your `reference_id`, tags and notes	Your workspace
Persons: owners and controllers	Your workspace
Transactions you push, upload or receive from a processor	Your workspace
Portfolio files you upload	Your workspace

Stripe access

Coris reads accounts, payments, refunds, disputes, payouts, balances and fraud signals, and creates its own webhook endpoints. It changes nothing else, unless you turn on actions that let Coris act on Stripe for you, such as pausing payouts. Onboarding gives you the exact permissions for a restricted key.

Each payment object can be turned off for your connection. Coris uses an optional second key only to read full identity details of accounts and persons.

Stripe webhook events

Coris creates one endpoint for your platform and one for connected accounts. They subscribe to events for accounts, payments, refunds, disputes, payouts, balances and fraud signals. After you connect, your Stripe dashboard shows the full list.

Coris rejects an event with a bad Stripe signature (400), and discards events it does not use.

Deleting the key in the portal stops event processing. Delete the key and endpoints in Stripe too.

Adyen access

Coris support connects Adyen with these:

Item	Use
Legal Entity Management API credentials	Read legal entities.
Configuration API credentials	Read account holders and balance accounts.
HMAC key	Verify each webhook.

Coris makes no write calls to Adyen. Send these events to the webhook URL Coris gives you:

balancePlatform.accountHolder.created  balancePlatform.accountHolder.updated
balancePlatform.balanceAccount.created  balancePlatform.balanceAccount.updated
balancePlatform.transfer.created  balancePlatform.transfer.updated
AUTHORISATION  CAPTURE  CHARGEBACK  NOTIFICATION_OF_CHARGEBACK  SECOND_CHARGEBACK
CHARGEBACK_REVERSED  REQUEST_FOR_INFORMATION  NOTIFICATION_OF_FRAUD

Coris rejects a delivery whose HMAC signature fails, and discards other event types. A live connection ignores test events.

Report a vulnerability

Email [email protected] with the host or endpoint, the steps to reproduce, and any Correlation-ID.

Next: Authenticate your requests