Trust & security

Presence you can hand over without losing control.

Autonomy without governance is a liability. CoreLayerEngine pairs full automation with the approvals, disclosures, audit trails and hardened engineering that make handing it over a sane decision.

Approvals & sign-off

Approve-first is the default, per brand and per channel. Sensitive accounts can require a named approver or two-person (maker ≠ checker) sign-off before anything ships. An API key is recorded as a machine actor, never a person, so it can never stand in as the second approver.

Disclosure built in

Sponsored posts are auto-stamped with #ad / paid-partnership disclosure, aimed at FTC and ASCI guidance — applied by the publishing path, not left to anyone to remember.

Tamper-evident audit

Every governance action is written to a hash-chained trail. Removing or altering a sealed record is detectable, and the chain head is printed on every CSV and PDF export so you can prove later what was approved, by whom, and when.

Hard limits

The engine never runs paid ads and never sends one-to-one direct messages, at any autonomy setting. Per-workspace velocity limits are derived from your own plan and clamped by an absolute ceiling no plan or override can exceed.

Hardened by default

TLS with HSTS, a strict Content-Security-Policy, frame-deny, request size limits, upload validation by true file type, SSRF protection on outbound calls, per-IP and per-action rate limiting, and containers that run as a non-root user.

Crisis ready

A live war-room detects reputation spikes, pauses automation until the alert is cleared, then reschedules what was held — with a compiled post-mortem. An operator kill-switch can stop automated publishing outright.

Your accounts

Tokens are the crown jewels. We treat them that way.

CoreLayerEngine acts through your connected accounts, so the access tokens it holds are the most valuable thing in the system — and the first thing an attacker would want.

OAuth tokens, two-factor secrets and webhook secrets are sealed with AES-256-GCM before they are written
Each ciphertext is bound to its own record, so a copied value cannot be reused elsewhere
Keys rotate without downtime or a migration; production will not start without one
Disconnecting revokes the grant at the platform for all eight platforms that offer it
Passwords and recovery codes are scrypt-hashed; two-factor can be enforced org-wide
Per-workspace scoping — data never crosses between brands

Where your data lives

Data is stored in India.

The region is not a label on a settings page — it decides which database holds your rows. A request for data a given node does not hold is refused outright, naming the node that does hold it, rather than quietly served from somewhere else. That refusal is the whole point: telling you your data is in one place while it sits in another is the failure this design exists to prevent.

Backups and recovery

Encrypted automated backups, 7 daily / 4 weekly / 12 monthly, stored in the same region as the data, with restores verified by an automated job. That job restores the newest backup into a scratch database and checks it is real; if it fails, goes stale or has never reported, it wakes someone up.

Backups include roles and grants as well as data, because a dump without them restores into a database the application cannot log in to.

Your data, and getting it out

Every category of operational data has a retention window and ages out on a schedule — raw social-listening mentions after 180 days (30 days for anything retrieved from the YouTube API, which is YouTube's own limit), notifications after 90, and so on. Workspaces can tighten those windows. Legal hold stops all automated deletion for an account.

You can export your content, contacts and full audit trail at any time. Deleting a workspace erases it and leaves only a tombstone containing no personal data. The full schedule is in the Privacy Policy; step-by-step removal instructions are on the data deletion page.

Every third party that can receive data is listed publicly, with purpose, data categories and region, on our sub-processors page. We give 30 days' notice before that list changes. We use no third-party product analytics, no error-tracking service, no advertising pixels and no session replay.

AI, and what we do not do with your data

Content is AI-generated and a human approves it. We do not train models on your data — CoreLayer’s own writing model learns only from posts written for our own accounts and for fictional test businesses. Outcome learning adjusts scoring weights on your workspace's own results, plus anonymous tone and format counts per trade that are used only once five businesses have contributed — and that any workspace can switch off.

Where we call Anthropic or OpenAI directly, their API terms state inputs are not used to train their models. Where the configured provider is OpenRouter, requests are brokered onward and we cannot give one no-training guarantee across every model reachable that way — ask us and we will pin your workspace to a direct provider. Exported creative carries a real C2PA Content Credentials manifest recording that it was AI-made — readable by any C2PA tool, and tamper-evident.

Built like infrastructure.

CoreLayerEngine is built and operated by Ektasi Technology (OPC) Private Limited, an India-based software company, from a registered office in Varanasi, Uttar Pradesh.

Read our story →

Governed autonomy, out of the box.

Turn it on with confidence. Start free and set your guardrails in minutes.

Start free Ask a security question →