Legal Compliance & Security Architecture

Security and legal enforceability form the foundation of Cora Studio OS. All contracts, invoices, and financial records are engineered to withstand scrutiny in Indian courts and statutory audits.

1. Indian IT Act 2000 Compliance

All signatures captured in Cora comply with Sections 4 and 5 of the Indian Information Technology Act, 2000 for electronic contract execution:

• Signer Verification: Signer IP address, browser user-agent, and email magic token are immutably bound to the record.
• Date & Call-Time Stamp: Exact execution date and time (IST) are stamped on every document page.
• Non-Repudiation: The signer must explicitly check clause checkboxes and sign the HTML5 canvas before the certificate is sealed.

2. Cryptographic SHA-256 Hashing

When an agreement is executed, the server renders a PDF and calculates its unique SHA-256 checksum:

Original PDF Bytes ──> [ SHA-256 Hash Engine ] ──> e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

If even a single character or metadata byte is altered post-signature, the checksum validation fails immediately.

3. Data Protection & Tenant Isolation

• SSL/TLS 1.3: All traffic in transit is encrypted using modern TLS 1.3 ciphers.
• SQL Parameterization: Every database interaction uses parameterized prepared statements via $wpdb->prepare().
• Zero Third-Party Trackers: No third-party ad pixels or tracking scripts operate inside the private workspace SaaS shell.