Security & privacy
Built to pass your security review
Certified controls, telemetry that stays outside your login path and hosting in the region you choose. Reports, policies and certificates are in our Trust Center.
Certifications and audits
ISO 27001
Our information security management system is ISO 27001:2022 certified and overseen by our CISO: policies, risk assessments, incident management and regular internal and external audits.
SOC 2 Type II
An independent auditor examined our controls for security, availability and confidentiality over a twelve-month period, including Corbado Observe. The report is available under NDA.
FIDO® Certified
Corbado Connect is FIDO® Certified as a FIDO2 server (Full Certification). Look it up in the FIDO certification register.
The FIDO, FIDO ALLIANCE, FIDO AUTHENTICATION, FIDO CERTIFIED and FIDO2 trademarks and logos are trademarks of FIDO Alliance.
How Corbado Observe handles data
Outside the login path
The script loads asynchronously and sends telemetry fire-and-forget. If Observe is unavailable, measurement pauses. Logins never wait for it.
You choose the identifier
Journeys are linked by an identifier you control, such as a pseudonymous user ID instead of an email address.
First-party, no cookies
Client state lives in first-party localStorage. Observe sets no cookies.
Fits a strict CSP
Two allowlist entries: script-src cdn.corbado.com and connect-src api.cloud.corbado.io. Your IDP, sessions and user database stay untouched.
Integration details: Corbado Observe documentation.
Hosting and availability
Your region, your choice
The shared cloud runs on AWS in Frankfurt, Germany. Dedicated instances run in the AWS region you pick, for data residency rules such as GDPR or DPDP.
Availability tiers
Dedicated instances come as Standard (99.9% monthly availability), Multi-AZ (99.99% for event ingestion) or Multi-AZ with geo-redundancy and failover to a second region.
Separated environments
Development, staging and production are logically separated with their own access controls. Backups use point-in-time recovery and are tested.
Recovery objectives and support terms per configuration: Observe deployment and availability and Connect deployment options. If the Connect passkey component is disrupted, login falls back to your existing methods automatically.
Engineering and privacy practices
- Security and privacy by design across the development lifecycle
- Mandatory peer review and automated static analysis for every change
- OWASP-aligned secure coding, vulnerability scanning before deployment
- Formal change management for software and infrastructure
- TLS 1.3 in transit, encryption at rest, least-privilege access
- 24/7 production monitoring and a tested incident response process
- No production personal data in development or test environments
- Data minimization: only an identifier, IP address and user agent for core services
Connect API rate limits
Corbado Connect APIs allow up to 50 requests per second. Above that, requests from the same IP address receive HTTP 429 for 10 minutes. To raise the limit, reach out via Slack or contact@corbado.com.