How we handle your systems and data

Our work touches production systems that run real operations. These are our defaults. Where your own policies go further, we follow yours, and the engagement contract records which apply.

Access

  • We work inside your accounts and repositories, under named user accounts you control and can revoke at any time.
  • Least-privilege access by default, with production access limited to the people who need it for the current task.
  • Single sign-on and multi-factor authentication wherever the system supports it.
  • Access is reviewed at the end of each phase and removed when an engagement ends.

Data

  • Your data stays in infrastructure you control. We do not copy production data to personal devices.
  • Data is encrypted in transit and at rest using the platform’s standard controls.
  • Test environments use masked or synthetic data when the real thing is not needed.
  • We follow your retention rules and delete working copies at the end of an engagement.

AI and models

  • We use model providers and settings that do not train on your data, and we document which providers process what.
  • Agents get the narrowest tool permissions that do the job, and actions with real consequences go through human review.
  • AI features ship with logging, an evaluation set built from your own documents, and a spending limit.
  • Sensitive fields can be redacted before any text leaves your environment.

Engineering

  • All changes go through version control and code review, with an audit trail of who changed what.
  • Secrets live in a managed secret store, never in code or chat.
  • Dependencies are pinned and scanned, and we patch known vulnerabilities as part of normal work.
  • Backups are tested by restoring them, not assumed.

Your questionnaire, your rules

We are happy to complete your vendor security questionnaire, sign an NDA or data processing agreement, and work under your existing policies. We describe our practices here instead of listing badges, and we will tell you plainly if a requirement is something we cannot meet.

To report a security concern about this website or our work, emailinfo@corply.ai with “Security” in the subject line.