How we use data

This page explains what data flows through the platform when you browse, upload, and run agents.

Data you provide

When you run an agent

Inputs may include:

• customer text (support tickets, chats)
• business context (policies, docs)
• structured fields (CRM attributes)

Where data goes

Corgent integrates with external services for core product functionality:

• Supabase: auth and database (EU / Frankfurt primary)
• OpenRouter: model inference with Zero Data Retention (ZDR) and data_collection=deny under a Data Processing Agreement; inference may run on provider infrastructure outside the EU
• Stripe: billing and credit purchases
• Resend: transactional email
• PostHog: product analytics and LLM usage telemetry (when enabled)

Minimization principles

We aim to collect and process the minimum data required to:

• run the agent
• compute usage/billing
• provide logs and debugging

Guidance for customers

• Remove unnecessary PII from prompts
• Send only the slices of documents needed for the task
• Prefer structured extraction over open-ended generation for critical workflows

Common questions

Do you store my prompts?

Depending on your configuration and the workflow, prompts may be processed for execution and operational visibility. To reduce risk, design prompts so they don’t include secrets.

Can we run in a restricted environment?

If you need stricter controls (network isolation, vendor restrictions), contact us and we can discuss options.

Security practices