Security
How we protect your help desk data
Kora Reply runs on a server in Jakarta, Indonesia behind Cloudflare, encrypts all traffic, keeps each workspace's data apart at the database level and backs up the help desk database every day. Kora Reply is not SOC 2 or ISO 27001 certified. This page describes the setup as of 26 October 2026.
Hosting
Where your data lives
- Server: the Kora Reply app and its PostgreSQL database run on a virtual private server at Hostinger's data center in Jakarta, Indonesia.
- Network: all traffic to korareply.com passes through Cloudflare, which terminates TLS and filters attacks before requests reach the server.
- Email: incoming support email reaches Kora Reply through Cloudflare Email Routing and a signed Cloudflare Worker; replies to your customers are sent through Resend.
- AI: when the AI assistant is switched on for an inbox, the customer's message and the matching help center articles are sent to Anthropic (with OpenAI as a fallback) to write the answer. AI run logs store usage and cost, not message text, and mask emails and phone numbers.
Protection
Encryption, access and isolation
| Area | How it works today |
|---|---|
| In transit | HTTPS only, with HSTS. Cloudflare connects to our server over TLS with a verified certificate (Full strict). |
| Passwords | Stored only as scrypt hashes. Login and password reset are rate limited; reset links work once and expire after 60 minutes. |
| Sessions | HttpOnly, Secure, SameSite cookies. The server keeps only a hash of each session and visitor token. |
| Channel secrets | WhatsApp access tokens and app secrets are encrypted with AES-256-GCM before they are stored; only the last characters are ever shown again. |
| Workspace isolation | Every row carries its workspace, and PostgreSQL row-level security limits each request to one workspace. Automated isolation tests run on every change. |
| Team access | Owner, admin and agent roles decide who can change settings, channels and the knowledge base. |
| Help center content | Articles are sanitized: scripts, frames and forms are never rendered, and help centers send a strict Content Security Policy. |
| Bot protection | Cloudflare Turnstile checks signups, the contact form and a new chat visitor's first message, on top of per-IP limits. |
| Payments | There is no card checkout on the site, so we store no card data. |
Backups
Backups and recovery
- Daily database backup: the help desk database (conversations, contacts, articles, settings) is dumped every day and the last 14 daily copies are kept on the server's backup storage. In the worst case, up to 24 hours of changes could be lost (recovery point).
- Full server backups: Hostinger also takes a backup of the whole server, currently about once a week, stored separately from the server.
- Restore tested: on 26 October 2026 we restored a fresh dump into a separate scratch database and every table's row count matched the source. We plan to repeat the test every month.
- We do not offer a contractual recovery time yet. Kora Reply is a new product run by a small team, and we say so.
Honest limits
What we do not have yet
- No SOC 2, ISO 27001 or HIPAA certification, and no third-party penetration test yet.
- No single sign-on (SSO) or two-factor login yet.
- No choice of data region: everything is hosted in Indonesia.
If your company needs any of these before it can buy, tell us. It helps us decide what to build next.
Report
Report a security issue
Email hello@korareply.com with "Security" in the subject and enough detail to reproduce the issue. We reply within 1 business day (see our support hours) and keep you updated until it is fixed. Please do not access other people's data or disrupt the service while testing.
Security questions before you sign up?
Ask us anything about how your data is handled. A person from the team replies.