Built like the stakes are real — because they are
Coordinator holds your books, your client list and your work. This page describes, in plain language, how it's protected — the same discipline whether an action comes from a person, an AI agent, or a connected tool.
Every mutation passes through an authorization check against your live roles — per module, per legal entity, with type and category fences. Fenced-out data is filtered in the query, not hidden by the interface, so there is nothing to inspect your way into. Read-only means the mutation path doesn't exist for you.
Connected-provider credentials — Stripe, PayPal, Wise, video, calendar, mail, SMS, AI keys — are encrypted at rest (AES-256-GCM), accepted only after a real API round-trip proves them, and never returned to the browser again.
Every action emits a domain event under the identity that performed it — humans, AI agents (always attributed as agents), and connector tokens (marked as connector actions). Financial records add immutability: posted entries can only be corrected by linked reversals, and period locks hold against every role.
Hosted invoices, forms, booking pages and portals are addressed by high-entropy unguessable tokens (256-bit, hashed at rest). Every public surface is rate-limited server-side — per IP and per token — failing closed. Upload quotas are enforced, and images are re-encoded with location metadata stripped.
An MCP connector token grants the intersection of what you chose to lend and what your live role allows — re-resolved from the database on every request, never cached, capped below management rights, expiring in at most 90 days. Wrong-token guesses are rate-limited before any lookup, and every failure mode returns the same answer, so the endpoint leaks nothing. Connectors structurally cannot send money or messages, approve, or delete.
Payments settle directly between your customers and your own provider accounts. There is no balance with us, no float, nothing to freeze, and no payment data of your customers stored on our side beyond what your books record.
Sign-in, sessions and your data's exits
- Multi-factor authentication is supported on every account, free.
- Passwords are stored hashed; sessions are cookie-based and server-validated; disabling a member or a portal contact kills their access immediately, everywhere.
- Sharing is explicit. Cross-organization features move only the specific fields the product describes — never your costs, time, private records or internal notes — and ending a collaboration leaves each side holding its own data.
- Your data is exportable. Clean exits are a design rule, not a support ticket.
- Certifications: honestly — we don't hold SOC 2 or ISO 27001 today. The engineering discipline above is real and documented; formal audits come as the platform grows. If your organization needs specifics, write to us.
- Found something? Report vulnerabilities to support@coordinator.one — we read every report and act on the real ones fast.
Trust is earned in the details
Free to try, permissioned from the first minute, and your data leaves with you if we ever stop deserving it.
Free. No card. About two minutes to set up.