How we protect your account and your data

How we protect your account and your data: sign-in security, staff access, snapshots and backups, protection from attacks, and how to report a security problem.

What keeps your account safe, who at Coritan can reach it, how you keep copies of your servers and how to tell us about a security problem.

Keep your account yours

A second step at sign-in, sessions you can see and end, and keys that do only what you allow.

• Two-factor authentication. With it on, signing in takes your password and a six-digit code from an authenticator app on your phone. Someone who learns your password still cannot sign in. We send no codes by text message or email. Ten recovery codes let you in if you lose the phone. Turn on two-factor authentication
• Sessions you can end. The Security tab of Settings lists every browser and script signed in to your account, with its address and when it was last active. Sign out one of them, or every device but the one you are using, and within 10 seconds it can no longer reach your account. Changing your password does the same. Sign out and end sessions
• Passwords and connections. We store a one-way hash of your password (bcrypt), so nobody at Coritan can read it. coritan.com tells browsers to reach it over HTTPS only, so what you send us is encrypted on the way. Change your password
• API keys. Create a key for each script, with only the permissions it needs and the addresses it may be used from. We email you when a key is created, and you can revoke a key at any time. A script sends its key as Authorization: Bearer and calls the Coritan API as you. Your password, your team and your API keys still need you to sign in. Manage API keys

Who at Coritan can reach your account

Our staff work in an admin console of their own, with separate accounts and safeguards of its own.

• The admin console answers only at its own address, admin.coritan.com. Staff sign in there with staff accounts, which are separate from customer accounts.
• Its sign-in checks that a person is signing in, and stops an address that keeps getting the password wrong.
• Each member of staff has a role, and the role decides what they can see and change.
• The console records the changes staff make in an audit log.

Keep copies of your servers

Snapshots and backups hold a copy of a server’s files, and you decide when to take one and when to restore it.

• Snapshots. Take a snapshot of a server whenever you like, or on a schedule. It belongs to your account, so it stays after you delete the server, and you can restore it onto that server or another of yours. Lock a snapshot so that nobody deletes it by mistake. Snapshots and backups compared
• Automatic backups. A server can have a backup taken each day, with the last 7 kept. They come with the plans that include them, and you can add them to a paid server. The pricing page says which. Take a server snapshot
• A snapshot before we remove a server. When we remove a server because it was cancelled or not paid for, we take a snapshot of it first, so you can get the server back. When you cancel a server, you can choose not to keep one.

Snapshots and backups do not hold a server’s databases. Back up a database

Protection from attacks

DDoS Shield filters attack traffic where it enters our network, before it reaches your server.

DDoS Shield checks the traffic sent to your floating IPs at the points where it enters our network, so it drops an attack before the attack reaches your server. It covers every floating IP from the moment we assign it, and nothing needs switching on when an attack starts.

A server without a floating IP, such as a web service, is reached on the shared address of its machine, which DDoS Shield does not filter. Attach a floating IP to put the server behind it.

DDoS Shield · Get help with an attack now

Report a security problem

Tell us about a weakness you found in Coritan. This is our vulnerability policy, and the same contact details are in our security.txt file.

Where to send a report

Email support@coritan.com with Security in the subject, and say what you found. If you have an account, you can open a conversation on the Support page of the dashboard instead. Our security.txt file has the same contact.

What to include

• What you found, and where you found it.
• The steps that show it, and the time you saw it.
• Nothing that belongs to someone else: leave out passwords, recovery codes, card numbers and other people’s data.

What we ask of you

• Report the problem to us privately, and give us time to fix it before you tell anyone else.
• Test only against accounts and services you own.
• Do not read, change or delete another customer’s data.
• Do not run a test that makes a service slow or unavailable, and do not use social engineering against our staff.
• Do no more than it takes to show that the weakness exists.

What we do

We look into each report and tell you what we decide.

Other reports

• For spam, an attack or other abuse from an address or a service on Coritan, email abuse@coritan.com.
• For a question about your personal data, email privacy@coritan.com.