Security

Last updated 1 September 2026

Core5 holds your working life. Here is exactly how it is protected, and where the limits are.

Where your data is

Your tasks, projects and settings live in a Postgres database hosted by Supabase in Ireland, inside the EU. Encrypted in transit with TLS and at rest with AES-256.

Row-level security

Every table carries a policy that ties each row to the account that owns it, and the check runs in the database, not in the app. It is the difference that matters: a bug in the app cannot hand you someone else's row, because the app is not the thing deciding. The same rule applies to the Claude connector — it queries with your session, never with an administrator key.

Your Google keys

Held in the operating system's keychain on your own devices, protected by the hardware, and never written to disk in the clear.

A copy of the refresh token — the permission, not your data — is also held on our server, encrypted with AES-256-GCM using a key kept outside the database, so a copy of the database is worth nothing on its own. No person and no client can read it: the row has no read policy at all. It exists so that one thing keeps working when every one of your devices is off: your instant mail alerts stay alive. Disconnecting the account in Core5 deletes it, and revoking Core5 in your Google account ends it everywhere.

Your mail and calendar still move between your device and Google directly.

Backups

Taken every three hours, encrypted, and kept for fourteen days — in two separate places, because a backup that lives only on the machine it protects guards against a mistake but not against a lost laptop. Restoring is tested, not assumed: the restore path is rehearsed against real data, and it never deletes as part of restoring.

What we do not have

• No analytics, telemetry, session recording or crash reports carrying your content.
• No advertising identifiers and no third-party trackers — on the site or in the app.
• No copy of your mailbox. Messages are never stored on our servers — the only thing held there is the Google permission itself, sealed with a key that is not in the database, used by one automated job and readable by no person and no client.

The honest limits

Core5 is built and run by one person. That means fast fixes and no committee, and it also means there is no 24/7 on-call rota and no SOC 2 report to hand you. If your organisation needs one to approve a tool, Core5 is not there yet — and telling you that now is cheaper for both of us than telling you in procurement.

Reporting a problem

If you find a security issue, write to contact@core5app.com with the details and how to reproduce it. You will get a reply within 72 hours, and credit if you want it. Please do not test against other people's accounts.