Trust & Security

Security at C0RTEX

C0RTEX is an AI customer-support service operated by Perfect Paradox Ltd. This page explains, in plain terms, how we protect your data and your customers' data. It describes our current technical and organisational measures — not marketing.

01Per-client isolation

C0RTEX is single-tenant by design. Each customer runs in their own isolated Docker container, with their own encrypted data volume, their own subdomain and their own resource quota. One customer's data is never co-mingled with another's in a shared database.

02Encryption

At rest

Customer data is stored on an AES-256-GCM encrypted filesystem (gocryptfs). Backups snapshot the ciphertext only — plaintext never leaves the running service.

In transit

All traffic is served over HTTPS/TLS with automatically renewed certificates (Let's Encrypt). HSTS is enforced.

03Access & authentication

Account passwords are hashed with scrypt (per-account salt); we never store them in plaintext.
Sessions use random tokens stored only as a hash, in HttpOnly, SameSite=Strict cookies with a bounded lifetime. Optional two-factor authentication (TOTP) is available.
Admin/operator access is separated from customer accounts. Secrets (API keys, webhook secrets, the encryption passphrase) live outside the codebase and outside any chat or repository.
The web app enforces a strict Content-Security-Policy (nonce-based, no inline scripts), plus anti-CSRF, rate limiting, and X-Frame-Options: DENY / nosniff.

04Your data & the AI

C0RTEX answers using your documents (the knowledge you upload). It is built to defer honestly when it doesn't know, rather than invent answers.
The language model runs via the Anthropic (Claude) API. Per our agreement, your content is not used to train models.
A change to your business profile (prices, hours…) is recorded in a tamper-evident, append-only log (HMAC hash-chain) — so there is sealed proof of what your assistant was configured to say, and since when.

05Sub-processors

We use a small, named set of providers. Each is bound by its own data-processing terms:

Provider	Purpose	Region
Anthropic	Language model (Claude) that drafts answers	US
Hostinger	Server hosting (VPS)	EU
Paddle	Payments & invoicing (Merchant of Record, handles VAT)	UK/EU
Resend	Transactional email (verification, notifications)	US/EU
Let's Encrypt	TLS certificates	—

06Backups & recovery

Encrypted backups run on a daily schedule: 14 days retained on the server and 90 days off-site, with integrity verified (SHA-256) and restoration tested. Because we snapshot the ciphertext, backups are useless without the separately held encryption key.

07Compliance & legal

Perfect Paradox Ltd is a UK company (NI739317, Belfast, Northern Ireland), registered with the UK ICO (C1898593).
We act as a data processor; you (our customer) are the controller of your end-customers' data. A Data Processing Agreement is available, covering sub-processors, breach notification, international-transfer safeguards (UK IDTA / SCCs) and retention.
See our Privacy Policy and Terms of Service.
Healthcare: if you intend to process special-category health data (e.g. a clinic), additional safeguards (UK GDPR Art. 9 terms and a DPIA) apply before processing — talk to us first.

08Certifications

C0RTEX follows practices aligned with recognised security frameworks (SOC 2 and ISO/IEC 27001 control areas: access control, encryption, change management, incident response, vendor management). We are not yet independently certified — we'll pursue formal SOC 2 / ISO 27001 audits as we scale and where enterprise customers require them. For due-diligence or a security questionnaire, contact us and we'll share our current documentation.

Responsible disclosure. Found a security issue? Email security@perfectparadox.co.uk (or info@perfectparadox.co.uk). We'll acknowledge and work with you in good faith; please don't access data that isn't yours.