How Corial handles your data

Where your data lives

Customer Data (the database, document storage, audit logs, application servers) is hosted in the European Union on Hetzner Online GmbH infrastructure, in Nuremberg and Falkenstein. Hetzner’s data centres are ISO/IEC 27001 certified.

For AI inference, Corial offers two routing tiers. The choice is made per tenant.

The EU residency tier routes every AI call through EU data centres. Anthropic Claude models are served on Google Cloud Vertex AI under licence; Google Gemini models run directly on Vertex AI. See the sub-processor list for the full inventory and regions.

AI providers and training

Corial uses commercial API tiers from Anthropic, Google, and Mistral. Under the providers’ commercial terms, the data we send through their APIs is not used to train their models.

We rely on third-party providers because the language and reasoning capabilities of frontier models cannot currently be matched in-house at the quality our customers expect. We pick providers against the rubric published in the Responsible AI Charter. We do not disclose which model handles which internal task; the routing itself is part of what makes the product work. The full set of providers is listed in the sub-processor list.

See the model card →

Encryption

All data is encrypted in transit using industry-standard TLS. Sensitive data is encrypted at rest at the application layer. The underlying infrastructure is Hetzner, which is ISO/IEC 27001 certified for physical and operational security.

Authentication and access

Access requires authenticated user sessions with short-lived tokens. Passwords use industry-standard one-way hashing. Multi-factor authentication is available. Four roles separate platform, tenant administrator, user, and read-only access. API requests are rate-limited.

Multi-tenant isolation

Corial serves multiple customer organisations from a single system. Data belonging to one tenant must never be visible to another. Isolation is enforced at both the application and database layers and is covered by automated tests in the backend test suite.

Audit logging

Sensitive operations are written to an immutable audit log retained for the lifetime of the tenant account. Coverage is expanded based on our internal review against the ISO/IEC 42001 controls.

Backups and recovery

The Corial database is backed up daily and retained for 30 days. A weekly automated restore drill verifies that the backup is recoverable end to end. Backups are encrypted during creation and stored on the same Hetzner infrastructure that hosts the live database. Off-site geographic backup redundancy is on our roadmap.

Deleting your data

Tenants own their data. Account deletion requests go to privacy@corial.app, and we process them within 30 days. That includes removal from third-party sub-processors that retain copies. Inside the live application, deactivated records are flagged inactive until the tenant requests removal or terminates the contract.

Sub-processors

The full sub-processor list is at corial.app/legal/subprocessors. We notify customers at least 30 days in advance of any addition or replacement.

Incident response and breach notification

We maintain an internal Incident Response plan covering detection, severity classification, containment, eradication, customer notification, and post-mortem. If a personal-data breach occurs, we notify affected customers and (where applicable) the French CNIL within 72 hours of becoming aware, per Article 33 of the GDPR. Customers may report suspected security issues to security@corial.app.

GDPR and the EU AI Act

OpenCream SAS is established in France and acts as a data processor on behalf of our tenants. We comply with the GDPR, the French Data Protection Act, and the EU AI Act. Our Privacy Policy sets out the legal bases for processing and how to exercise your rights as a data subject.

Under the EU AI Act, Corial is a limited-risk AI system: a workplace assistant that interacts with users in natural language. Interactions with Corial are generated by AI. Outputs shown to your customers (for example, drafted emails) are reviewed and sent by you, not by Corial on its own.

Standards alignment

Corial’s AI management practices are designed in alignment with ISO/IEC 42001:2023, specifically the controls covering multi-tenant data isolation, security of AI systems, AI lifecycle operation, intended use, and third-party AI provider management. Corial is not certified to ISO/IEC 42001 and makes no claim of certification.

Corial is built to the SOC 2 trust-services principles for Security and Confidentiality. Multi-tenant isolation is enforced at the application and database layers, authentication uses short-lived JWTs with bcrypt password hashing, sensitive credentials are encrypted at rest with Fernet, traffic is TLS-terminated with HSTS, and daily database backups are verified weekly by automated restore. Corial has not undergone a SOC 2 audit and does not hold a SOC 2 report.

We maintain an internal gap analysis against both standards and prioritise remediation based on customer demand and risk. We will pursue formal certification when the business case calls for it.

Responsible AI

OpenCream maintains a public Responsible AI Charter setting out which providers we use, the criteria we pick them against, and the behaviours we commit to and refuse. The Charter is signed by the founder and reviewed annually.

Documents

Public artefacts are linked below. The internal gap analysis, security overview, and the latest controls report are available to prospects and customers under a non-disclosure agreement.

Service status

Internal uptime monitoring is active. Probes against the web application, the API, the marketing site, and the AI providers run continuously, and on-call alerts route to the founder by phone the moment something fails.

A public status dashboard is provisioned and available to customers and prospects on request. We will publish it on a public URL when customer demand calls for it. Suspected outages can be reported to security@corial.app.

Contact

Privacy and data protection: privacy@corial.app

Security disclosures and incident reports: security@corial.app

Concerns about how Corial uses AI, handles data, or operates — open to anyone, with a written non-retaliation commitment: concerns@corial.app. See the concerns page.

OpenCream SAS
15 Avenue Marie-Amélie
60500 Chantilly, France