Corex360 Security
CRM security: tested against attack,
built for defence.
Corex360 Security is the security layer that protects the platform from both sides: regular penetration tests probe it from an attacker's point of view, and layered defence keeps every access on record. Whether your data sits on your own server or on Corex360 Cloud, the same security layer runs.
Two directions
From which two sides is Corex360 security built?
Security is built from two sides. On one side are penetration tests that probe the platform regularly; on the other, the defence layer that runs under every record. The platform has been through a comprehensive penetration test, carried out in-house with Corex360 Security. On the defence side, permissions are role-based; sign-ins, devices, and access are on record, files in Corex Drive are encrypted and tied to permissions, and encrypted backups are taken daily.
Attack
The platform is tested from the attacker side.
- 01Penetration tests
The platform has been through a comprehensive penetration test, carried out in-house with Corex360 Security, which the Corex360 team developed. It is tested regularly from an attacker's point of view.
- 02The outside view
The test looks at how the platform appears from outside: where would an attacker try to get in.
Defence
The same layer runs under every record.
- 01Identity and access
Role-based permissions; every user sees only the records within their role, and a permission change needs manager approval.
- 02Logging and alerts
Sign-ins, devices, and access are logged; an unusual event is reported to the account owner at once.
- 03Files
In Corex Drive files are encrypted and tied to permission; sharing uses timed, revocable links.
- 04Backups
Backups are encrypted and taken daily; if something goes wrong, records are restored from the latest daily backup.
Which three layers run on the same record?
Identity, files, and monitoring; all three run on the same core, not as a separate module. In the identity layer, access is role-based and a permission change is logged with manager approval. In Corex Drive, a file is encrypted and tied to its record and to permissions. In the monitoring layer, every access is on record, and an unusual event reaches the account owner.
Identity and permissions
Role-based access; permission changes approved by a manager and logged.
Files and sharing
In Corex Drive files are encrypted and tied to the record and permission.
Monitoring and alerts
Every access logged; an unusual event reaches the account owner.
Hosting
Where does your data live, and who chooses?
You choose: Corex360 runs either on Corex360 Cloud, in a company-specific space on DigitalOcean infrastructure, or on your own infrastructure, where the server, disk, and network are under your control. The choice is written into the agreement. The same Corex360 Security layer runs in both; sign-in, device, and access records are kept the same way, and an unusual event is reported to the account owner.
A company-specific space on DigitalOcean infrastructure, written into the agreement.
- Same layer
The same Corex360 Security layer runs in both hosting options.
- Same trail
Sign-in, device, and access records are kept; an unusual event is reported to the account owner.
Corex360 runs on your own infrastructure with the same security layer.
- Data stays with you
Server, disk and network under your control.
- Same trail
Sign-in, device, and access records are kept the same way.
| Topic | Corex360 Cloud | On your own server |
|---|---|---|
| Where the data sits | A company-specific space on Corex360 Cloud, written into the agreement. | Corex360 runs on your own infrastructure. |
| Security layer | The Corex360 Security layer | The same Corex360 Security layer |
| Sign-in, device, and access records | Kept; an unusual event is reported to the account owner. | Kept the same way. |
| Server, disk, and network | On Corex360 Cloud infrastructure | Under your control |
What does KVKK (Turkey's data protection law) ask for in data processing?
Personal data is processed under KVKK (Turkey's personal data protection law). The law asks for three things: telling people, putting the processing relationship in writing, and answering requests. The notice tells people which data is processed, for what purpose, and for how long. The data processing agreement puts in writing on whose behalf, for what purpose, and under which safeguards data is processed. A person can in turn ask about their data and request that it be corrected or deleted.
If you are outside Türkiye, your own country's data protection law also applies; Corex360 does not claim compliance with it. You choose where the data is kept: Corex360 Cloud or your own server.
- 01Notice
People are told which data is processed, for what purpose, and for how long.
- 02Data processing agreement
Puts in writing on whose behalf, for what purpose, and under which safeguards data is processed.
- 03Data subject requests
A person can ask about their data and request that it be corrected or deleted.
Open topics
Which topics are left for the demo?
Security details not yet written on the site are collected here: how penetration test findings are closed, where backups are kept and how recovery is tested, who holds setup and maintenance on your own server, the scope of the data processing agreement, export formats, encryption, the country of the Corex360 Cloud servers, and which provider a question goes to when X AI is used. In the demo call we go through them against your own setup.
- Penetration test
How findings are closed.
- Backups
Where backups are kept and how recovery is tested.
- Your own server
How setup and backups run on your side.
- Maintenance
Who holds maintenance and updates.
- KVKK
The scope of the data processing agreement and how requests are handled.
- Export
Export formats and handover when the contract ends.
- Encryption
How encryption covers data in transfer and in storage.
- Hosting country
Which country the Corex360 Cloud servers are in.
- AI
Which AI provider a question goes to when X AI is used.
FAQ
On security, what do people ask most?
Security questions are mostly about where the data lives, who sees what, whether the platform is tested, what happens in an unusual event, KVKK, and handover of data when the agreement ends. The short answers: data lives where you chose in the agreement, permissions are role-based, the platform is tested regularly from an attacker's point of view, and an unusual event is reported to the account owner at once.
01Where is my data hosted?
Your choice: in a company-specific space on Corex360 Cloud or on your own server, written into the agreement. Corex360 Cloud servers run on DigitalOcean infrastructure. The same security layer runs in both.
02Who can see what?
Permissions are role based. Every user sees only the records within their role; a permission change needs manager approval and is logged.
03Are penetration tests performed?
Yes. The platform has been through a comprehensive penetration test, carried out in-house with Corex360 Security, which the Corex360 team developed. It is tested regularly from an attacker's point of view. How findings are closed is on the list of open topics.
04How do I find out if something goes wrong?
An unusual event is reported to the account owner at once; sign-ins, devices, and access are logged.
05How is personal data handled under KVKK?
Personal data is processed under KVKK (Turkey's personal data protection law). Access is role-based and every access is logged. The scope of the data processing agreement and how requests are handled appear among the open topics.
06Can I export my data?
Your data sits where the agreement says: in a company-specific space on Corex360 Cloud or on your own server. Export formats and handover when the contract ends are also on the list of open topics.
Keep going
Read more on this
Sources
- Personal Data Protection Law (mevzuat.gov.tr) Last checked
Resources
Related pages
Last updated