Controls, evidence and accountability.

Identity document checks, selfie liveness and face matching are performed by Didit, our identity-verification provider, inside the provider's hosted verification flow.

CoreOps does not store biometric templates, selfie images, liveness videos or document images on its own systems. We retain the verification outcome, document metadata (type, issuing country, validity) and the provider's session reference so that a verification can be evidenced and re-validated.

Verification sessions are linked to a single-use partner invitation; verification data is never reused across partner networks.

Workspace gateways are provisioned per contractor with a dedicated static egress address. Traffic between the contractor's workstation and the gateway is end-to-end encrypted, and gateway credentials are unique per contractor and revoked when an engagement is terminated.

Static addresses are published to partner networks for client allow-listing, so client security teams can restrict access to a known, fixed origin instead of a changing residential address.

CoreOps operates an anti-money-laundering programme aligned with United States requirements. Every contractor is screened against sanctions, politically-exposed-person and adverse-media lists at onboarding through our verification provider, and partner networks are subject to know-your-business review before activation.

Partner-network payments are invoiced and reconciled through regulated payment institutions; invoice numbers, amounts and payment references are retained for the statutory period.

Contractors attest to independent-contractor status and residence in the jurisdiction verified by their identity document. The attestation is recorded with the Terms of Service version, a content hash, timestamp, IP address and user agent.

Every onboarding step and every portal action, including sign-ins, page requests, document downloads and status changes, is written to an append-only audit ledger with timestamp, IP address, user agent and, where available, network geolocation.

Partner networks can review the ledger for their own contractors; CoreOps compliance staff can review the complete ledger. Audit records are never edited or deleted by application users.

Platform data is stored in access-controlled, encrypted-at-rest databases with row-level security, so each partner network and each contractor can only read their own records.

Personal data is processed under the Privacy Policy and retained only as long as required for the engagement, billing and statutory record-keeping. Data-subject requests can be addressed to the compliance desk.