Security

Caura is operated by Caura Innovation Ltd (Israel). This page summarises our security program for prospective customers and procurement teams. For contractual security commitments, see Annex II of the Data Processing Addendum.

Caura runs on Google Cloud Platform. Compute is provided by Cloud Run; the primary database is AlloyDB for PostgreSQL; caching and sessions use Memorystore (Redis); asynchronous events flow through a managed message queue. Production workloads currently reside in the us-central1 region.

In transit. All external and inter-service traffic is encrypted with TLS 1.2 or later.

At rest. Google Cloud encrypts all persistent storage at rest with Google-managed keys (AlloyDB, Cloud Storage, Memorystore).

Tenant isolation. Every authenticated request is resolved to a single tenant on the server, from the credential itself rather than from any client-supplied value, and access to Customer Data is scoped to that tenant in the application’s data-access layer.

Credentials. End-user passwords are hashed with Argon2id and a per-password salt. API keys are stored as SHA-256 digests; newly generated keys contain 256 bits of random material. The clear-text key is shown only once at creation and cannot be retrieved later.

Production access is limited to a small number of named engineers, who hold IAM roles on Google Cloud. Administrative access requires two-factor authentication. Break-glass access events are logged and reviewed.

Customers can sign in with email + password (Argon2id-hashed, rate-limited), GitHub OAuth or Google OAuth. A successful password-change request revokes other sessions while keeping the session that made the change.

Structured application logs are retained centrally on Google Cloud Logging. Authentication-event IP addresses are captured for abuse detection and purged after 90 days.

Automated database backups are retained up to 90 days on a rolling basis. Backup storage is encrypted at rest. Restore procedures are tested at least quarterly. Target recovery point objective (RPO) is 24 hours; target recovery time objective (RTO) is 24 hours.

Our CI pipeline runs dependency scanning on every pull request. We welcome reports of vulnerabilities from security researchers at security@caura.ai. Please allow reasonable time for investigation and remediation before public disclosure.

Third-party services that help operate Caura are listed publicly at /legal/subprocessors. Sub-processor DPAs are reviewed before onboarding.

Caura is SOC 2 Type II compliant. The report is available to customers and prospects on request, under NDA, through your account manager or info@caura.ai. ISO 27001 is under evaluation; this page is updated as audits complete.

For security questionnaires, DPIA support, penetration-test summaries, or other procurement documentation, email security@caura.ai.