Trust

Coram is closed source. That is a choice, and it costs us something, so here is what we publish instead.

Nothing has been published yet. Coram is not in use by any group, and there is nothing to audit or report on. This page will fill in as that changes. We would rather show you an empty page than a promise.

Independent security audit

Published in full, including findings we have not fixed yet. Scope: multi-tenant isolation, the API, cloud IAM, and CI/CD.

Not published yet. Cadence: annual.

Transparency report

Subpoenas received, complied with, and challenged. How many users we were able to notify.

Not published yet. Cadence: semiannual.

Warrant canary

A short signed statement that no secret subpoena has been served. We publish the cadence so that silence is itself the signal.

Not published yet. Cadence: quarterly.

Export and self-host documentation

How to take everything with you, and how to run this yourself. Kept current because an export nobody can use is not an export.

Not published yet. Cadence: every major release.

The canary

Not published yet.

It is a PGP-signed text file at /canary.txt, and the signing key is at /.well-known/coram-pgp.asc. Nothing in our codebase generates or signs it. Signing is a manual act by a person, because a canary is only worth anything if that person is free to decline.

A welcome table with a clipboard, name tags and coloured pens as people arrive.
A sheet on a table is still the most common database in this movement. This is what we are asking you to trust us with instead.

What we do not do

Reporting something

Security contact and PGP key are in security.txt. We will publish findings we have not fixed yet, including in the annual audit.