Skip to content

Trust center

What we do to protect your customers' data, stated plainly. If a control is not in place yet, this page says so.

SOC 2 readiness in progress (not certified)

Controls in place

  • Tenant isolation

    Every customer workspace is isolated in the database with Postgres row-level security, and every server-side read is also filtered by the workspace it belongs to.

  • Encryption

    TLS 1.2 or higher on every connection, with HSTS.

    AES-256 encryption at rest for the database and file storage (Supabase on AWS), plus AES-256-GCM application-layer encryption for integration tokens and credentials.

  • Data location

    Customer data is stored and processed primarily in Mumbai, India: the database runs on Supabase (AWS ap-south-1) and the application on Vercel (bom1).

  • Sign-in security

    Two-factor authentication (authenticator app) is available to every user in Settings, Security. Agency owners can require two-step login for their whole team in the console (Security). Other workspaces cannot require it for a team yet.

    Single sign-on (SAML) for agency teams is not self-serve yet: the agency adds its identity provider and domains in the console (Security), then Corebee support finishes the connection. Other workspaces cannot use single sign-on yet.

  • Audit log

    • Settings changes, with the old and new value and who made them
    • Conversation assignments and resolutions
    • Data exports
    • Messages sent by your team
    • Actions the AI assistant proposed, ran or failed

    Sign-in and sign-out events are not recorded in this log yet.

  • Retention and deletion

    Kept while your account is active and deleted on the schedule below when it ends. Agency workspaces can also set a shorter retention window per company.

    After an account ends, you have 30 days to export your Customer Data. Corebee then deletes it from its live systems within a further 30 days, and encrypted backups roll off within 90 days.

Session replay runs only with your consent, and form fields are masked. It never runs in the agency console, on your customers' chat pages, or for signed-in Corebee staff.

Compliance status

SOC 2 readiness work is underway; Corebee is not SOC 2 certified and has no SOC 2 report yet.

Documents

Security contact

Report a vulnerability or ask a security question: support@corebee.ai.