Security and compliance

# Your trial data stays isolated, and stays yours.

Your own private instance, in your own region. Access is by role, and nothing you put in is used to train a model.

[Book a demo](https://www.cori-clinical.com/contact) [Report a security issue](mailto:security@cori-clinical.com)

EU, US and UK data residency

## Certifications held

ISO/IEC 27001 Certified

GDPR Complied with

EU AI Act Complied with

GxP aligned Complied with

The full security posture is documented at trust.cori-clinical.com. Certificates and the current subprocessor list are available under NDA. Ask on the call, or write to security@cori-clinical.com.

How it is built

## The controls, group by group.

How your data is stored, who can reach it, and what the audit trail says.

### Protection

#### Encryption at rest and in transit

AES-256 at rest, TLS 1.2 and 1.3 in transit, with keys rotated on a fixed schedule.

#### Continuous monitoring

Threats, vulnerabilities and anomalies are monitored continuously rather than periodically.

### Access

#### Strict access controls

Role-based permissions and multi-factor authentication. Access that was refused is logged too, not just access that was granted.

#### Regional processing and hosting

Processed and hosted in your region. The region is set when your account is created, and support cannot change it.

### Governance

#### Data ownership and confidentiality

Never used to train models, never shared without consent, reachable on a need-to-know basis.

#### Governance you can read off the screen

Access, controls and activity across every document and user, without assembling it by hand.

Good to know

## The questions procurement asks first.

### Is Cori certified?

Cori Clinical holds ISO/IEC 27001 certification and complies with the GDPR and the EU AI Act. The scope covers the design, development and operation of the platform, including customer trial data hosted in the EU, US and UK regions. The full posture, with certificates, lives at trust.cori-clinical.com.

### Where is our trial data hosted?

Each customer runs in an isolated deployment, hosted in the EU, the US or the UK.

### Is our data used to train models?

No. Customer content is never used to train models, and no model provider retains it. A zero data retention policy applies to every model call the platform makes.

### What does the audit trail cover?

Every action is logged, and the log is enforced by the database rather than by the application, so an altered entry shows. Deleting a user does not erase what they did, and access that was refused is logged alongside access that was granted.

### How do we report a security issue?

Write to security@cori-clinical.com. Reports are triaged on receipt and acknowledged before any public disclosure is coordinated.

## The full detail, under NDA.

Book thirty minutes with us, or write to security@cori-clinical.com and we will take it from there.

[Book a demo](https://www.cori-clinical.com/contact)