Snapshot 253533
Normalized text
Scripts and page chrome removed; this is what change detection compares.
WebinarLive on Nov 19: Building a Business Case for PasskeysPasskey Business Case, recording for all registrantsRegister Security & privacy Built to pass your security review Certified controls, telemetry that stays outside your login path and hosting in the region you choose. Reports, policies and certificates are in our Trust Center. Open the Trust CenterTalk to our security team Certifications and audits ISO 27001 Our information security management system is ISO 27001:2022 certified and overseen by our CISO: policies, risk assessments, incident management and regular internal and external audits. SOC 2 Type II An independent auditor examined our controls for security, availability and confidentiality over a twelve-month period, including Corbado Observe. The report is available under NDA. FIDO® Certified Corbado Connect is FIDO® Certified as a FIDO2 server (Full Certification). Look it up in the FIDO certification register. The FIDO, FIDO ALLIANCE, FIDO AUTHENTICATION, FIDO CERTIFIED and FIDO2 trademarks and logos are trademarks of FIDO Alliance. How Corbado Observe handles data Outside the login path The script loads asynchronously and sends telemetry fire-and-forget. If Observe is unavailable, measurement pauses. Logins never wait for it. You choose the identifier Journeys are linked by an identifier you control, such as a pseudonymous user ID instead of an email address. First-party, no cookies Client state lives in first-party localStorage. Observe sets no cookies. Fits a strict CSP Two allowlist entries: script-src cdn.corbado.com and connect-src api.cloud.corbado.io. Your IDP, sessions and user database stay untouched. Integration details: Corbado Observe documentation. Hosting and availability Your region, your choice The shared cloud runs on AWS in Frankfurt, Germany. Dedicated instances run in the AWS region you pick, for data residency rules such as GDPR or DPDP. Availability tiers Dedicated instances come as Standard (99.9% monthly availability), Multi-AZ (99.99% for event ingestion) or Multi-AZ with geo-redundancy and failover to a second region. Separated environments Development, staging and production are logically separated with their own access controls. Backups use point-in-time recovery and are tested. Recovery objectives and support terms per configuration: Observe deployment and availability and Connect deployment options. If the Connect passkey component is disrupted, login falls back to your existing methods automatically. Engineering and privacy practices Security and privacy by design across the development lifecycle Mandatory peer review and automated static analysis for every change OWASP-aligned secure coding, vulnerability scanning before deployment Formal change management for software and infrastructure TLS 1.3 in transit, encryption at rest, least-privilege access 24/7 production monitoring and a tested incident response process No production personal data in development or test environments Data minimization: only an identifier, IP address and user agent for core services Connect API rate limits Corbado Connect APIs allow up to 50 requests per second. Above that, requests from the same IP address receive HTTP 429 for 10 minutes. To raise the limit, reach out via Slack or contact@corbado.com.