Security

Last updated 1 September 2026

Core5 holds your working life. Here is exactly how it is protected, and where the limits are.

Where your data is

Your tasks, projects and settings live in a Postgres database hosted by Supabase in Ireland, inside the EU. Encrypted in transit with TLS and at rest with AES-256.

Row-level security

Every table carries a policy that ties each row to the account that owns it, and the check runs in the database, not in the app. It is the difference that matters: a bug in the app cannot hand you someone else's row, because the app is not the thing deciding. The same rule applies to the Claude connector — it queries with your session, never with an administrator key.

Your Google keys

Held in the operating system's keychain on your own devices, protected by the hardware. They are never transmitted to us and never written to disk in the clear. Your mail and calendar move between your device and Google directly.

Backups

Taken every three hours, encrypted, and kept for fourteen days — in two separate places, because a backup that lives only on the machine it protects guards against a mistake but not against a lost laptop. Restoring is tested, not assumed: the restore path is rehearsed against real data, and it never deletes as part of restoring.

What we do not have

• No analytics, telemetry, session recording or crash reports carrying your content.
• No advertising identifiers and no third-party trackers — on the site or in the app.
• No access to your mailbox. Even with full server access, your Google tokens are not there.

The honest limits

Core5 is built and run by one person. That means fast fixes and no committee, and it also means there is no 24/7 on-call rota and no SOC 2 report to hand you. If your organisation needs one to approve a tool, Core5 is not there yet — and telling you that now is cheaper for both of us than telling you in procurement.

Reporting a problem

If you find a security issue, write to contact@core5app.com with the details and how to reproduce it. You will get a reply within 72 hours, and credit if you want it. Please do not test against other people's accounts.