Enterprise-grade security, built in.

Cora keeps detailed logs of all relevant system activities, access controls, and security events, ensuring comprehensive audit trails are always available. Activities are date and time stamped giving you a full audit history.  

Cora provides mandatory security training throughout the year, covering a broad range of security topics. This training is updated regularly to address the latest threats. 

Cora is independently audited every year under SOC 1 Type II and SOC 2 Type II, and is certified to Cyber Essentials and Cyber Essentials Plus. Our security controls are aligned to ISO/IEC 27001, although we are not ISO 27001 certified.

Cora encrypts all sensitive data in transit using TLS 1.2 or higher with common secure ciphers and encrypts data at rest using AES-256. 

Cora uses an MDM solution to enforce antivirus, local firewall, disk encryption, auto updates, screen timeout, and to remotely lock and wipe devices that are lost or stolen. 

The only mandatory personal data which Cora require is a name and work e-mail address to enable users’ access for login purposes. Thereafter, it depends on what if any personal data a customer as the data controller chooses to upload. Given the nature of PPM, it is not envisaged any personal or sensitive data would be stored or hosted on the PPM application however it is the responsibility of the Customer to be aware of what if any personal data it will store on the application.

 If you are an existing customer, you as the Data Controller are best placed to answer what personal data you are storing on your PPM instance.

Cora enters a Data Processing Agreement with each customer, which aligns with all GDPR requirements. Further detail is available in Cora Data Processing Agreement - Cora Systems. Details of how Cora protects customer data can be found in Cora Security Addendum - Cora Systems.

Yes. Details of the location, personal data processed and transfer mechanism relied upon, are available in Sub Contractors and Processors List - Cora Systems.

Cora is a cloud-based solution, hosted on Azure. Customers’ hosting location is aligned to the customer’s location, unless a different location is specifically requested. If you are new customer, you can discuss your requirements with your Account Executive who will liaise with our infrastructure department on your request.

A CSR will contact customers at the appropriate time in relation to deletion and/or return of its data. If a customer wishes to have its data returned, Cora PPM has self-service functionality for customers to extract their data from PPM. Where a customer requires technical assistance for example, it does not want to use the self-service functionality and/or has specific requirements around the format it wants the data returned in, this will be charged on a time and materials basis.

If you are an existing customer and have queries or concerns around data retrieval or deletion, you should contact your CSR who will assist you.