Trust and security
How CoreCx protects every conversation: the standards we use, the limits we publish, and how to reach us if you find a problem.
Protection at every layer.
Encryption at rest
AES-256-GCM per recording, with keys wrapped by post-quantum ML-KEM.
Key custody
The master key is split between two of your people, with offline recovery.
In transit
Modern TLS and encrypted media between every component.
Audit
Tamper-evident logs, and every search, play, download and export recorded.
Hardened hosts
FIPS crypto policy, SELinux enforcing and CIS Level 2 settings from first boot.
Supply chain
Signed offline installers with checksum files, software bills of materials and a vulnerability gate on every release.
What we claim, and what we do not.
Security teams deserve the limits as well as the features.
| Area | Today | Direction |
|---|---|---|
| Post-quantum | FIPS 203 ML-KEM in the key manager and recorder, with a hybrid mode | Broader hybrid defaults |
| FIPS validation | FIPS crypto policy on CoreCx EL. No FIPS 140-3 module certificate is claimed. | Under review |
| Hardware security module | Software appliance | Hardware-backed master key |
| Key manager availability | Single node with offline custodian recovery | Clustering |
| Vulnerability assessment | Published, with no known applicable vulnerabilities in shipped components | Independent penetration test |
| Sign-in | Directory and single sign-on, with one-time codes on the wallboard | Multi-factor sign-in on every console |
Your data stays with you.
CoreCx never sends your data back to us or to anyone else. Your data stays where you put it.
- On-premise deployments need no cloud account at all
- On-premise AI models are delivered with the installer and run on your servers
- Licences are signed files, so nothing is checked over the internet
- Backups and archives go only to storage you choose
- Report a security issue and we acknowledge it within two business days
Protecting patient information
Healthcare deployments keep patient data inside the hospital group and under its control.
Healthcare solutions- Inside the network. HealthForce, recording and AI run in the group’s cloud or on its own servers
- Your keys. Patient recordings are sealed with keys held by the hospital group
- Consent first. Offers are only sent to patients who have agreed to receive them
- Full audit. Every patient interaction is logged for review
Get the security pack
Our vulnerability assessment, security reference and published limits, ready for your review.