Trust center

What we do to protect your customers' data, stated plainly. If a control is not in place yet, this page says so.

SOC 2 readiness in progress (not certified)

Controls in place

Tenant isolation
Every customer workspace is isolated in the database with Postgres row-level security, and every server-side read is also filtered by the workspace it belongs to.
Encryption
TLS 1.2 or higher on every connection, with HSTS.
AES-256 encryption at rest for the database and file storage (Supabase on AWS), plus AES-256-GCM application-layer encryption for integration tokens and credentials.
Data location
Customer data is stored and processed primarily in Mumbai, India: the database runs on Supabase (AWS ap-south-1) and the application on Vercel (bom1).
Sign-in security
Two-factor authentication (authenticator app) is available to every user in Settings, Security. Requiring it for a whole team is not available yet.
Single sign-on (SAML or OIDC) is not available yet.
Audit log
- Settings changes, with the old and new value and who made them
- Conversation assignments and resolutions
- Data exports
- Messages sent by your team
- Actions the AI assistant proposed, ran or failed
Sign-in and sign-out events are not recorded in this log yet.
Retention and deletion
Conversations, transcripts and attachments are kept until you delete them, unless you set a retention window per company (30 days to 2 years) in the agency console. Until deletion is switched on, a window is a preview and nothing is deleted.
After an account ends, we delete its data on written request within 30 days, and confirm in writing.

Session replay runs on our website, and inside the product with the visible text and form fields masked (images are not masked); it never runs in the agency console or on your customers' chat pages.

Compliance status

SOC 2 readiness work is underway; Corebee is not SOC 2 certified and has no SOC 2 report yet.

Documents

Data Processing Agreement
The full agreement with a plain-English summary.
DPA, signable PDF
Template for signature. Have your counsel review it.
Sub-processors
22 vendors, what each one processes and where. Last changed 2026-09-26.
Security practices
Encryption, access control, AI guardrails and data handling in detail.
Privacy policy
What Corebee collects about its own users and visitors.

Security contact

Report a vulnerability or ask a security question: jonathan@corebee.ai.

Controls in place

Tenant isolation

Every customer workspace is isolated in the database with Postgres row-level security, and every server-side read is also filtered by the workspace it belongs to.

Encryption

TLS 1.2 or higher on every connection, with HSTS.

AES-256 encryption at rest for the database and file storage (Supabase on AWS), plus AES-256-GCM application-layer encryption for integration tokens and credentials.

Data location

Customer data is stored and processed primarily in Mumbai, India: the database runs on Supabase (AWS ap-south-1) and the application on Vercel (bom1).

Sign-in security

Two-factor authentication (authenticator app) is available to every user in Settings, Security. Requiring it for a whole team is not available yet.

Single sign-on (SAML or OIDC) is not available yet.

Audit log

Settings changes, with the old and new value and who made them
Conversation assignments and resolutions
Data exports
Messages sent by your team
Actions the AI assistant proposed, ran or failed

Sign-in and sign-out events are not recorded in this log yet.

Retention and deletion

Conversations, transcripts and attachments are kept until you delete them, unless you set a retention window per company (30 days to 2 years) in the agency console. Until deletion is switched on, a window is a preview and nothing is deleted.

After an account ends, we delete its data on written request within 30 days, and confirm in writing.

Session replay runs on our website, and inside the product with the visible text and form fields masked (images are not masked); it never runs in the agency console or on your customers' chat pages.

Documents

Data Processing Agreement

The full agreement with a plain-English summary.

DPA, signable PDF

Template for signature. Have your counsel review it.

Sub-processors

22 vendors, what each one processes and where. Last changed 2026-09-26.

Security practices

Encryption, access control, AI guardrails and data handling in detail.

What Corebee collects about its own users and visitors.