ColeoidSystems

Trust Center

What we ship, what we say, and what we don't claim.

Coleoid holds no certifications. Rather than stay quiet about that, every claim below carries its own status — and the ones we cannot make are listed alongside the rest.

10
Implemented
6
Stated
6
Not claimed

Last reviewed 2026-08-21

The ledger

Implemented
Shipped and in use. The linked page describes how it works.
Stated
Our position. You are taking our word for it.
Not claimed
We do not do this, or cannot evidence it yet. Listed so you do not have to ask.
Filter claims by status

Showing 22 of 22

  • ImplementedWorkspace access is role-controlledEvery read and write resolves the caller's membership and role capability before it runs.Security & Data
  • ImplementedEvery graph change is written as a typed eventRoles, processes, and relationships change through one append-only path, so the workspace holds a record of what changed.Security & Data
  • ImplementedEvery organizational record carries its organizationOrganization identity sits on the row rather than being inferred from the request.Security & Data
  • ImplementedFailed sign-ins are counted without storing addressesThe limiter keys on an HMAC derived from the normalized email and address context, not on the values themselves.Security & Data
  • ImplementedPassword reset links are single-use and expireLinks are stored hashed, lapse after 30 minutes, and a successful reset ends every existing session.Security & Data
  • ImplementedInvitations are single-use tokens with an expiryThe raw token appears only in the invite link, is stored hashed, and lapses after seven days.Security & Data
  • ImplementedIdentified analytics and session recording need consentNothing is tied to a person, and nothing is recorded, until you say yes.Security & Data
  • ImplementedRecording excludes request bodies and headersAutomatic exception capture is switched off, and analytics properties are named explicitly rather than collected by default.Security & Data
  • ImplementedYour data leaves in a format you can openCharts export as images and the workspace exports as a localized spreadsheet, both generated in your browser.Data rights
  • ImplementedA vulnerability-reporting policy is publishedsecurity.txt names the address, the policy page, and an expiry date.security.txt
  • StatedIncidents are investigated, contained, and documentedReport anything you find to hello@coleoid.systems. There is no published transparency report yet.Security & Data
  • StatedAdministrative access follows least privilegeOperator access is limited to what a task needs, and has not been audited by a third party.Security & Data
  • StatedPersonal-data requests are answeredWrite to hello@coleoid.systems; the timing we work to is on the data-rights page.Data rights
  • StatedWhat we collect, why, and on what legal basisSix categories of information, each with its purpose and legal basis, are listed in the privacy policy.Privacy
  • StatedColeoid is operated by Eurosis ConsultingColeoid is a product name; there is no separate company called Coleoid Systems Inc.About
  • StatedThe service terms are published in fullIncluding what the service does not warrant and where liability ends.Terms
  • Not claimedSOC 2 and ISO 27001Coleoid holds neither. No audit is in progress, and this line will say so when one starts.No page to link
  • Not claimedVerified hosting providers and regionsWe will publish the inventory and transfer safeguards after verifying live production projects. Ask before sending anything sensitive.Contact
  • Not claimedStrict tenant isolationRecords are organization-scoped and access is role-controlled, but isolation has not been audited, so we do not claim it.Security & Data
  • Not claimedSelf-service account deletionDeletion is by request today, handled by a person rather than a button.Data rights
  • Not claimedCryptographically signed exportsExports are readable files. Nothing in them is signed, so nothing in them proves provenance.No page to link
  • Not claimedMeasured outcomesNo time saved, no percentage improved. We have not run a study, so there is no number to give you.No page to link

Where to go next

Public explanations

What Coleoid is and how it handles information

Read the product background, privacy policy, and service terms.

Explore

Real channels

Ask a question or make a request

One public address receives every enquiry, with a stated response window.

Explore

Evidence

See the practices we can substantiate

Security and analytics details distinguish implemented controls from unverified facts.

Explore

Not answered here?

Ask, and we will add the answer to this page.

Ask a question