Trust Center

We only list what exists. What is in progress says so.

Database, files and sign-in are hosted by Supabase in Frankfurt. The application runs on Railway in Europe. AI requests go through OpenRouter's EU endpoint with zero data retention to model operators that process in the EU. The list below comes live from our server.

Who serves AI requests

Loading live information…

To be clear: several providers are US companies with an EU region (among them OpenRouter, Supabase, Railway). They may be subject to US law even when the data stays in the EU. We additionally encrypt chat and document content ourselves.

For professions bound to secrecy there is a mode that allows only EU models and switches off every provider outside the EU (web search, geolocation).

Every provider that processes personal data on our behalf, with purpose and region. We announce new ones 30 days in advance.

Full list with data categories and erasure paths

• Chat, knowledge document, task run and file content is encrypted at the application level with AES-256-GCM, on top of infrastructure encryption.
• Strict tenant separation: every query is bound to user and organization and tested automatically; row level security on every table.
• Write actions of the AI (sending an email, changing a record) need a human approval, checked by the server, not the interface.
• Sign-in with passkeys and two-factor authentication; API keys cannot grant approvals.
• AI providers do not store requests (zero data retention) and do not train on them.
• Retention periods are enforced every night; diagnostic data contains no content.
• Software bill of materials (SBOM) for every version; security updates follow a fixed process.

• Intended purpose: Corgent supports office, sales and support work. High-risk uses such as selecting applicants or evaluating employees are excluded (acceptable use policy).
• Anyone who chats with Corgent or receives a message from an AI colleague learns that an AI is involved (Art. 50(1)).
• Machine-readable marking of AI-generated content (Art. 50(2)): in progress, deadline 2 December 2026.
• AI literacy course in the product with evidence export for admins (Art. 4).

Admins can export all data of their organization at any time as a ZIP: JSON files per area (chats, colleagues, tasks and runs, skills, knowledge, connections without credentials, approvals, billing, settings) plus the uploaded original files, with a manifest and SHA-256 checksums. We charge no switching fees.

Format: corgent.organization-export, schema 1.0.0, JSON per RFC 8259 in UTF-8.

Corgent's infrastructure is in the EU (Frankfurt, Railway's Europe region). Providers based in the US can be compelled to disclose data. Against that we use application-level encryption with keys only Corgent holds, contractual commitments of our providers and data minimisation. If we receive a disclosure request from a third country, we review it, disclose only the minimum and inform you beforehand where we are allowed to.

We send these documents on request. Some are still under legal review; we will tell you when that is the case.

• Data processing agreement (DPA) with technical and organisational measuresView onlineRequest
• Support pack for your data protection impact assessmentRequest
• Works council pack: framework agreement template, log data sheet, settingsRequest
• Addendum for professions bound to secrecy (§ 203 StGB, § 43e BRAO, § 62a StBerG)Request
• Switching annex (Data Act)Request
• Acceptable use policy and intended purposeRequest

Found a vulnerability? Report it to us confidentially. We confirm receipt within two working days.

Vulnerability disclosure policysecurity.txt

Privacy and documents

mk@corgent.ai

Security

security@corgent.ai