1. Enterprise-Grade Security Architecture

At CoreFare, we process thousands of daily mobility transactions, making security the bedrock of our platform. We deploy a multi-layered security architecture designed to protect passenger data, secure payment flows, and ensure high availability for transport operators. Our practices align with industry standards and best practices for critical infrastructure.

2. Cloud Infrastructure & Hosting

• Isolated Environments: The CoreFare platform is hosted on Tier-1, ISO 27001, SOC 2, and PCI-DSS certified cloud providers. We utilize virtual private clouds (VPCs) with strict network segmentation.
• High Availability & Disaster Recovery: Our architecture includes multi-zone redundancy, automated load balancing, and real-time database replication. We maintain an aggressive Recovery Time Objective (RTO) and Recovery Point Objective (RPO) to ensure transport operations never stop.
• DDoS Protection: Web Application Firewalls (WAF) and active DDoS mitigation services are deployed at the edge to block malicious traffic and automated botnets before they reach our servers.

3. Data Encryption & Cryptography

• Data in Transit: All communications between our mobile apps, web dashboards, field validators, and backend servers are encrypted using TLS 1.2 and TLS 1.3 with strong cipher suites.
• Data at Rest: Databases, object storage, and backups are encrypted at rest using AES-256 encryption. Encryption keys are managed via secure Hardware Security Modules (HSMs) and managed Key Management Services (KMS).
• Hardware Security (Validators): Our onboard validators and point-of-sale terminals use Secure Access Modules (SAM) to authenticate transit cards. We support MIFARE DESFire EV2/EV3 standards, utilizing AES cryptography to prevent card cloning and tampering.

4. Access Control & Authentication

Protecting the administrative side of transport operations is critical to preventing internal fraud and unauthorized access.

• Role-Based Access Control (RBAC): Operators can define granular permissions. A ticketing agent can only view their own shift reports, while fleet managers have access to overarching revenue dashboards.
• Multi-Factor Authentication (MFA): Administrative and management dashboards require MFA (via SMS, email, or authenticator apps) for all privileged accounts.
• Audit Logging: Every action taken within the CoreFare Manager and Connect dashboards—from issuing a refund to altering a route schedule—is immutably logged with user, timestamp, and IP address for full accountability.

5. Payment Processing Security

CoreFare does not directly process or store raw credit/debit card data. We tokenize all payment instruments via our PCI-DSS Level 1 certified payment gateway partners (such as Maya, GCash, and acquirer banks). Fare balances for closed-loop wallets are reconciled via double-entry accounting systems to detect and prevent balance manipulation.

6. Continuous Monitoring & Vulnerability Management

• Security Information and Event Management (SIEM): We continuously ingest and analyze platform logs to detect anomalous behavior, brute-force attempts, or unauthorized access.
• Penetration Testing: We engage independent, third-party security firms to conduct annual penetration tests and vulnerability assessments on our web and mobile applications.
• Patch Management: Our CI/CD pipelines include automated dependency scanning and container vulnerability checks, ensuring patches are applied rapidly to mitigate zero-day exploits.

7. Responsible Disclosure (Bug Bounty)

We value the expertise of the cybersecurity community. If you are a security researcher and believe you have discovered a vulnerability in the CoreFare platform, we ask that you disclose it to us responsibly.

Please email your findings to security@coretech.com.ph. We request that you do not publicly disclose the vulnerability until we have had a reasonable timeframe to investigate and patch the issue.

Trust

Security at CoreFare

Protecting your transport data and transactions.

1. Our Commitment to Security

CoreFare is designed to securely manage critical transport operations, fare collection, and passenger mobility data. We employ advanced security protocols to ensure that every transaction, ticket, and piece of operational data remains confidential and tamper-proof.

2. Infrastructure and Data Protection

• End-to-End Encryption: All data transmitted between the CoreFare app, terminals, and our cloud infrastructure is encrypted using TLS 1.3 or higher. Data at rest is encrypted using AES-256 standards.
• Cloud Security: Our platform is hosted on world-class, ISO 27001-certified cloud infrastructure, ensuring high availability, continuous monitoring, and automated threat detection.
• Regular Audits: We conduct periodic vulnerability assessments, penetration testing, and security audits to identify and mitigate potential risks proactively.

3. Identity and Access Management

Access to operational dashboards and passenger data is strictly controlled. We support role-based access control (RBAC), multi-factor authentication (MFA), and secure session management to prevent unauthorized access by personnel or external actors.

4. Payment Security

CoreFare integrates with PCI-DSS compliant payment gateways. We do not store full credit card numbers or sensitive payment authentication data on our servers. Closed-loop card transactions rely on secure, encrypted NFC and smart card protocols.

5. Incident Response

In the unlikely event of a security incident, our dedicated incident response team is prepared to act swiftly. We have established protocols for containment, investigation, and transparent communication with affected operators and regulatory bodies.

6. Reporting Security Issues

We welcome reports from security researchers and the community. If you believe you have found a security vulnerability in CoreFare, please report it immediately to info@coretech.com.ph.