Trust
Coram is closed source. That is a choice, and it costs us something, so here is what we publish instead.
Nothing has been published yet. Coram is not in use by any group, and there is nothing to audit or report on. This page will fill in as that changes. We would rather show you an empty page than a promise.
Independent security audit
Published in full, including findings we have not fixed yet. Scope: multi-tenant isolation, the API, cloud IAM, and CI/CD.
Not published yet. Cadence: annual.
Transparency report
Subpoenas received, complied with, and challenged. How many users we were able to notify.
Not published yet. Cadence: semiannual.
Warrant canary
A short signed statement that no secret subpoena has been served. We publish the cadence so that silence is itself the signal.
Not published yet. Cadence: quarterly.
Export and self-host documentation
How to take everything with you, and how to run this yourself. Kept current because an export nobody can use is not an export.
Not published yet. Cadence: every major release.
The canary
Not published yet.
It is a PGP-signed text file at /canary.txt, and the signing key is at /.well-known/coram-pgp.asc. Nothing in our codebase generates or signs it. Signing is a manual act by a person, because a canary is only worth anything if that person is free to decline.
