Security

This page is for security and compliance teams. The privacy policy covers personal data in full, and Privacy and security in the docs explains it for users.

Where data lives

• On the Mac: everything Coral reads (agent sessions, hook events, terminal state) and everything it keeps (Briefs, history, approval rules, iPhone chats).
• On a paired iPhone: the latest agent summaries from each Mac and Your Mac chats, including their screenshots. Opened conversations are shown, not saved. Unpairing deletes them.
• On our relay: encrypted messages waiting for delivery, push tokens, and the anonymous identities that link one Mac to one iPhone.
• With Anthropic, under your own account: Briefs, routing and Your Mac turns send short transcript excerpts, and for Your Mac, screenshots, to Claude through the developer’s own Claude Code login. Your organization’s agreement with Anthropic applies, the same one that covers the agent itself. These requests don’t pass through us.

Encryption and keys

• Every message between devices is encrypted for the receiving device’s key (HPKE with P-256 and AES-256-GCM) and signed by the sender (ECDSA P-256). We use Apple’s CryptoKit only, no custom cryptography.
• iPhone keys are created in the Secure Enclave and never leave it. The signing key needs Face ID, so every answer, message and Your Mac control sent from the iPhone proves the owner approved it.
• The Mac accepts a signed command only from a paired iPhone, only once, and only within 2 minutes, so copied or replayed messages are rejected.
• Pairing uses a one-time QR code that expires after 5 minutes, and both screens show a 6-digit code to compare, which catches a swapped key.
• All traffic to our relay, Polar and Apple uses TLS.

What the relay can see

The relay runs on Supabase. For each message it sees:

• which two paired devices it’s from and to, its size, and when it was sent,
• whether the Mac is online, asleep or quit,
• for Lock Screen Live Activities: how many agents are waiting, since when, and the Mac’s name.

It never sees message content. Each message is deleted once delivered, and after 24 hours if it isn’t. Row-level security limits every row to its two devices. Clients can’t list or read back messages, and calls are rate-limited per device.

Pushes carry encrypted content that the iPhone decrypts. Apple and we see only a generic line like “An agent needs you”.

The apps

• The Mac app ships outside the Mac App Store, signed with Developer ID and notarized by Apple. Updates are signed with a separate key, and installed copies refuse an update that isn’t.
• The apps have no analytics and no third-party SDKs. Crash reports are sent only when the user presses Send after seeing the exact report. They hold no code, paths or names and are deleted after 90 days.
• Coral’s limits on acting on the Mac (apps it never touches, caps on actions and time, stopping when someone uses the Mac) are enforced in Coral’s code, not left to the model, and the iPhone can’t lift them. See What Coral never does.

Subprocessors

• Supabase: the encrypted relay and crash reports.
• Apple: push notifications and Live Activities.
• Polar: merchant of record for payments, tax and license keys.
• Vercel: hosts this website.
• An email provider: customer email.

Compliance

SOC 2 and ISO 27001

Coral doesn’t have a SOC 2 report or ISO 27001 certification yet, and hasn’t had an independent penetration test. We’ll start SOC 2 when customers need it. Supabase, Vercel and Apple each hold their own SOC 2 Type II reports, and since Coral stores so little, most reviews come down to what’s on this page. We’re happy to fill in your security questionnaire.

GDPR, UK GDPR and Israel’s Privacy Protection Law

We handle personal data as described in the privacy policy, honor access and deletion requests within 30 days, and can sign a data processing agreement if your company needs one. Coral is based in Israel, which the EU recognizes as giving adequate protection to personal data.

HIPAA

Coral isn’t built to handle protected health information, and we don’t sign business associate agreements. If your agents might see PHI:

• Mac only is the safe setup. Without a paired iPhone, nothing about your agents reaches our servers.
• Don’t pair an iPhone, or don’t use Your Mac, on those machines. Encrypted as they are, conversations and screenshots would pass through the relay.
• Check your Anthropic agreement. Briefs and Your Mac send excerpts to Claude under your own account, so your organization’s terms with Anthropic decide whether that’s allowed.

Payments

Polar takes payments as merchant of record. Card data never reaches us, so PCI DSS doesn’t apply to Coral.

Reporting a vulnerability

Write to hello@usecoral.app with “Security” in the subject. We’ll reply within 3 business days, keep you updated while we fix it, and credit you if you’d like. Please give us a chance to fix it before you share it publicly. We won’t take legal action against good-faith research that avoids other people’s data.