Skip to main content
Corbado Observe runs within Corbado’s certified information security program. This page summarizes what a security review of Observe usually covers: certifications, how Observe affects your application, hosting, encryption and access control. For personal data, retention and user requests, see privacy and data policies.

​
1. Certifications

  • ISO 27001: Corbado operates a certified information security management system.
  • SOC 2 Type II: an independent audit confirms Corbado’s controls for security, availability and confidentiality. The report is available on request under a non-disclosure agreement.
The Corbado Trust Center provides the certificates, the SOC 2 Type II report, security policies and the list of subprocessors. The Corbado security page describes the security program in more detail.

​
2. Impact on your application

  • Outside the authentication path: Observe is telemetry only. It cannot grant, deny, delay or change a login. If the script, the SDK or event delivery fails, you lose telemetry, never an authentication.
  • No credentials: Observe does not receive passwords, one-time codes or passkey signatures. See built-in protections.
  • No backend integration required: event collection runs in your frontend or app. The server-side Observe API is optional and uses scoped keys.
  • Script delivery: the Autocapture bundle loads from Corbado’s CDN. Your Content Security Policy controls which origins can load scripts and receive events. Self-hosted or pinned deployments are possible with their own update process.

​
3. Hosting and encryption

  • Hosting: Corbado runs on AWS, with Frankfurt, Germany as the primary region of the public cloud. Dedicated instances in a chosen region are available for enterprise deployments. See projects, environments and hosting.
  • Encryption in transit: SDKs, API clients and the management console communicate with Observe over TLS 1.3.
  • Encryption at rest: stored data is encrypted.
  • Environment separation: Corbado separates development, staging and production with distinct access controls and least-privilege access for its personnel.
  • Backups: regular, tested backups with point-in-time recovery.
  • Monitoring and incidents: infrastructure is monitored around the clock, with an incident response process for detection, containment, investigation and resolution.

​
4. Access control

​
5. Documents for your review

Use these sources for your procurement or security review:
  • Trust Center: the Corbado Trust Center provides the ISO 27001 certificate, the SOC 2 Type II report, security policies and the list of subprocessors.
  • Data protection: contact us for the data processing agreement and the technical and organisational measures.

Privacy & data policies

Built-in protections, retention per purpose and user requests.

Console access & SSO

Enterprise single sign-on for the management console.