Every document is encrypted
Each stored document has its own key. Social Security numbers, birth dates and account numbers are encrypted a second time, field by field. The master key sits in a locked file on our server, never in code.
Built to protect borrower files.
A loan file holds the most private papers a person owns. This is what we do to protect them.
Passkeys or authenticator codes
Staff, Company admins and Partners must sign in with a passkey or an authenticator code. Clients use a one-time link and a text message code. Sessions are short.
Each Company is walled off
The database itself enforces isolation. One Company cannot read another Company's files, even if a mistake slips into the application code.
Wire-fraud shield
Coralstone never sends, confirms or changes wire instructions by email or text. We tell every party to confirm wiring details by phone with title, using a number they already know.
Every sensitive view is logged
Each reveal of a sensitive field, each use of a shared login and each Coral action is written to an audit log.
Uploads are scanned
Every file is scanned for malware before anyone opens it.
Coral works inside guardrails
Coral writes, texts and calls only the parties on the file. It never shares a document outside the file. These rules run in code, not in a prompt, so no instruction in an email can change them.
Encrypted backups
Backups are encrypted, and we keep only the newest three.
Read how we handle personal information in ourPrivacy Notice.