The security we can describe, and nothing more.
Technical measures that can be verified in the Cortex code: authentication, file isolation, deposits, webhooks and limits. No invented certification.
What this page is, and is not
This page describes mechanisms present in the service code on 30 October 2026. It helps a buyer or a fiduciary understand the control; it does not replace an audit.
It is not an ISO or SOC certificate, a penetration-test report, or a guarantee that no incident will occur. Your account settings stay in the signed-in space.
Account access
Sign-in uses Passport and a session stored in PostgreSQL. The session cookie is httpOnly; in production it is also marked secure.
Passwords are stored as hashes (bcrypt, with a gradual migration to scrypt).
Authenticated API mutations (POST, PUT, PATCH, DELETE) are protected against cross-site requests by a CSRF token. Public paths, webhooks and authentication routes are exempt.
Separation of files
Business data is attached to a file identifier (cible_id). The fiduciary context resolves that file for the signed-in user before reads.
This separation is application-level. PostgreSQL does not apply automatic RLS here. A forgotten filter on a new route would remain a real risk — that is why we say it.
Document deposit
A file is not accepted on its extension alone. The service compares the declared type with the magic bytes and rejects inconsistent content.
Image OCR goes through Google Cloud Vision, via its Zurich access point.
Payments and e-mail
Stripe receives payment events. If the webhook signing secret is missing, verification fails instead of accepting the event.
Transactional e-mail goes through Brevo. E-mail webhook signatures are compared in constant time.
Where the service runs
The web application, the worker, the files and the database run at Infomaniak, in Geneva.
Document processing goes through four processors in Switzerland: Infomaniak, Google Cloud Vision, DeepL and Microsoft Azure. Payment, e-mail and error tracking use other providers, listed in the privacy policy; their countries and clauses remain to be confirmed.
Retention of source files
Source PDFs and images of documents, and the export PDF ZIP, are deleted after 48 h. Journals, Excel files and extracted data remain downloadable.
Entries and extracted data are not deleted with the sources: they remain available as long as the account exists.
Honest limits
The rate limiter lives in process memory. It is not shared across several machines.
Security headers (CSP, HTTPS) are applied by the server. No measure can guarantee the complete absence of an incident.
Author, date and sources
Cortex editorial team · updated 30 October 2026. Every claim on this page points to a file in the repository or to an operational confirmation already written. What cannot be proved stays off this page.
- Authentication and sessions: server/auth.ts
- CSRF: server/middleware/csrf.ts
- File context: server/middleware/fiduciary-context.ts
- Deposits: server/middleware/upload.ts
- OCR: workflows/OCR/OCR.ts
- Stripe: server/integrations/stripe/stripe.ts
- Brevo: server/middleware/brevo-webhook-signature.ts
- Source purge: server/cron/data-cleanup.cron.ts