Security

1.How we protect CoreSync#

• Each ISP's data is kept separate, and every request is checked against the ISP it belongs to.
• Everyone signs in with their own account. Sign-in passwords are stored only as one-way hashes.
• Roles and fine-grained permissions decide what each user can see and do, and sensitive actions, such as extending service or giving credit, can require a second person's approval.
• Activity logs record who did what, and when.
• Websites, portals and APIs are served only over HTTPS.
• CoreSync reaches your routers and OLTs through private, encrypted tunnels (WireGuard or OpenVPN), and everything it creates on them is labelled "coresync".
• Bulk export of subscriber data is off for ISP users by default, and subscriber record views can be capped per account.
• Our servers run in Nairobi on infrastructure we operate, with access limited to authorised staff.

2.What we ask of you#

• Give each person their own login with only the permissions they need, and remove it when they leave.
• Turn on approvals for extensions, credits and refunds, so no one person can give away service alone.
• Keep routers, OLTs and other equipment on current firmware, and don't expose their management ports, such as Winbox, SSH or the RouterOS API, to the internet.
• Use strong, unique passwords for devices, payment accounts and SMS accounts, and change any that someone who has left may know.
• Tell us at once if you suspect your account or a connected device has been compromised.

3.Reporting a vulnerability#

If you believe you've found a security vulnerability in CoreSync, email hello@coresyncisp.com with "Security" in the subject. Tell us what you found, how to reproduce it and what impact you think it has. Please don't include other people's personal data.

We'll acknowledge your report within 3 business days, keep you updated, and tell you when it's fixed.

4.Rules for security research#

• Test only your own CoreSync account, or one you have written permission to test.
• If you reach another ISP's data or anyone's personal data, stop, don't keep or share it, and tell us.
• Don't disrupt the service: no denial-of-service, spam, or tests that slow CoreSync down.
• Don't use phishing or social engineering on our staff or ISPs, and don't try to enter our offices or server rooms.
• Don't touch network equipment that isn't yours, even if it's connected to CoreSync.
• Give us reasonable time to fix the issue, normally 90 days, before telling anyone else.

If you follow these rules in good faith, we'll treat your research as authorised, we won't take legal action against you over it, and we won't report it to law enforcement.

5.If something goes wrong#

If we discover a security incident affecting an ISP's data, we'll notify the ISP as the Data Processing Agreement sets out, and help it notify the Data Protection Commissioner and its subscribers where needed.