Trust & Safety

Security

We take the security of your data seriously. Here is how we protect it.

Data Encryption

  • All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher.
  • Data at rest is encrypted using AES-256 on our cloud infrastructure (Supabase / Google Cloud).
  • Database connections use SSL-enforced certificates.

Access Controls

  • Row-Level Security (RLS) enforced at the database layer ensures tenants can only access their own data.
  • Authentication is handled by Firebase Authentication with multi-factor authentication (MFA) support.
  • Role-based access control (RBAC) restricts features to authorized roles within each tenant workspace.
  • Administrative access to production systems requires multi-factor authentication and is logged.

Infrastructure

  • Hosted on Google Cloud Platform (Cloud Run) and Supabase, both SOC 2 Type II certified.
  • Frontend deployed via Vercel with automatic HTTPS and edge security.
  • Database backups are taken daily and retained for 30 days.
  • Authorized network access to production databases is restricted by IP allowlist.

Payment Security

  • Payment processing is handled by Stripe, a PCI DSS Level 1 certified provider.
  • Bank account linking uses Plaid, which employs bank-grade encryption and OAuth.
  • Corex IA never stores raw card numbers or bank credentials on our servers.

AI & Third-Party Services

Some Corex IA products include AI-powered features. When you use these features, anonymized or pseudonymized data may be processed by third-party AI providers including Anthropic and OpenAI. We do not send personally identifiable information to AI providers without your explicit consent. You will be asked to consent to AI features before first use.

Incident Response

In the event of a data breach that affects your personal information, we will notify affected users and relevant authorities within 72 hours of discovery, as required by applicable regulations. Notifications will be sent to the email address on your account.

Vulnerability Reporting

If you discover a security vulnerability in any Corex IA product, please report it responsibly:

Email: security@corex-ia.com

Please include a description of the vulnerability, steps to reproduce it, and any proof-of-concept code. Do not publicly disclose the issue until we have confirmed a fix.

We aim to acknowledge reports within 48 hours and resolve critical issues within 7 days.

Contact

For security questions or concerns: security@corex-ia.com

Last updated: October 27, 2026