> ## Documentation Index
> Fetch the complete documentation index at: https://docs.corbado.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security and Compliance

> Certifications, architecture, hosting, encryption and access control of Corbado Observe for your security review.

Corbado Observe runs within Corbado's certified information security program. This page summarizes what a security review of Observe usually covers: certifications, how Observe affects your application, hosting, encryption and access control. For personal data, retention and user requests, see [privacy and data policies](/corbado-observe/security/privacy).

## 1. Certifications

* **ISO 27001:** Corbado operates a certified information security management system.
* **SOC 2 Type II:** an independent audit confirms Corbado's controls for security, availability and confidentiality. The report is available on request under a non-disclosure agreement.

The [Corbado Trust Center](https://trust.corbado.com) provides the certificates, the SOC 2 Type II report, security policies and the list of subprocessors. The [Corbado security page](https://www.corbado.com/security) describes the security program in more detail.

## 2. Impact on your application

* **Outside the authentication path:** Observe is telemetry only. It cannot grant, deny, delay or change a login. If the script, the SDK or event delivery fails, you lose telemetry, never an authentication.
* **No credentials:** Observe does not receive passwords, one-time codes or passkey signatures. See [built-in protections](/corbado-observe/security/privacy#1-built-in-protections).
* **No backend integration required:** event collection runs in your frontend or app. The server-side [Observe API](/api-reference/observe/overview) is optional and uses scoped keys.
* **Script delivery:** the Autocapture bundle loads from Corbado's CDN. Your [Content Security Policy](/corbado-observe/get-started/autocapture#4-content-security-policy) controls which origins can load scripts and receive events. Self-hosted or pinned deployments are possible with their own update process.

## 3. Hosting and encryption

* **Hosting:** Corbado runs on AWS, with Frankfurt, Germany as the primary region of the public cloud. Dedicated instances in a chosen region are available for enterprise deployments. See [projects, environments and hosting](/corbado-observe/overview/constraints#8-projects-environments-and-hosting).
* **Encryption in transit:** SDKs, API clients and the management console communicate with Observe over TLS 1.3.
* **Encryption at rest:** stored data is encrypted.
* **Environment separation:** Corbado separates development, staging and production with distinct access controls and least-privilege access for its personnel.
* **Backups:** regular, tested backups with point-in-time recovery.
* **Monitoring and incidents:** infrastructure is monitored around the clock, with an incident response process for detection, containment, investigation and resolution.

## 4. Access control

| Access path              | Protection                                                                                                                                                               |
| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Management console**   | [SAML 2.0 single sign-on](/corbado-observe/overview/management-console-access) with your identity provider, such as Okta or Microsoft Entra ID                           |
| **Observe API**          | [API keys](/api-reference/observe/authentication) with operation-specific permissions, optional IP and CIDR restrictions and expiry. Personal keys expire within 90 days |
| **SDK event collection** | No API key in the browser or app. Events are accepted per project and only from the origins you register                                                                 |
| **Exports**              | Read permissions per export type. Files are downloaded through short-lived links                                                                                         |
| **Observe CLI**          | The [CLI](/corbado-observe/tools/cli) keeps the API key in the operating system's secret store                                                                           |

## 5. Documents for your review

Use these sources for your procurement or security review:

* **Trust Center:** the [Corbado Trust Center](https://trust.corbado.com) provides the ISO 27001 certificate, the SOC 2 Type II report, security policies and the list of subprocessors.
* **Data protection:** [contact us](mailto:support@corbado.com) for the data processing agreement and the technical and organisational measures.

<CardGroup cols={2}>
  <Card title="Privacy & data policies" icon="shield-halved" href="/corbado-observe/security/privacy">
    Built-in protections, retention per purpose and user requests.
  </Card>

  <Card title="Console access & SSO" icon="right-to-bracket" href="/corbado-observe/overview/management-console-access">
    Enterprise single sign-on for the management console.
  </Card>
</CardGroup>