CoRATES is in early access. We're actively building and welcome your feedback.

Security

How we protect your research data

At CoRATES, we understand that your research data is valuable and sensitive. We are committed to implementing robust security measures to protect your information and ensure the integrity of your evidence synthesis work.

Encryption

All data transmitted between your browser and our servers is encrypted using TLS (Transport Layer Security). Data at rest, including uploaded PDFs and application data, is encrypted using industry-standard encryption (AES-256-GCM) provided by our infrastructure providers.

Authentication

We support multiple secure authentication methods including OAuth (Google, ORCID) and passwordless login via email, with active session management so you can sign out other devices.

Abuse Prevention

Cloudflare's managed WAF and DDoS protection sit in front of every request. Sign-in, sign-up, emailed code, and password reset requests are rate limited per client, as are public forms such as contact and feedback.

Infrastructure

CoRATES is hosted on Cloudflare's global network, providing enterprise-grade security, DDoS protection, and a Web Application Firewall (WAF) to protect against common web vulnerabilities.

Access Control

Project-level access controls ensure that only authorized team members can view and edit your research data. You control who has access to your projects and can revoke access at any time. You retain full ownership of your research data. CoRATES does not sell or share your data with third parties.

Responsible Disclosure

We take security vulnerabilities seriously. If you believe you have found a security vulnerability in CoRATES, we encourage you to report it to us responsibly. We will not pursue legal action against researchers who report vulnerabilities responsibly and in good faith. Our full vulnerability disclosure policy covers scope, response times, and safe harbor, and is referenced from /.well-known/security.txt.

Please send details of the vulnerability to support@corates.org. Include as much information as possible, such as:

  • A description of the vulnerability
  • Steps to reproduce the issue
  • Potential impact of the vulnerability
  • Any suggestions for remediation

We will acknowledge receipt of your report within 48 hours and will work with you to understand and address the issue promptly. We ask that you give us reasonable time to investigate and mitigate the vulnerability before making any information public.

Security Questions

If you have any questions about our security practices or would like more information, please contact us at support@corates.org.