Your Information, Held Properly.

All client material is held in the European Union. Databases, file storage and the functions that process them run in an EU region. No client data is replicated outside it.

One process is worth naming separately, because a page that claimed no exception would be inaccurate. Analysis is produced by a language model, which means the text is sent to the model provider, processed and returned. That provider is named in the table below, it is contracted not to train on the material, and it is the only point at which client text leaves infrastructure we control. [Confirm the processing region and the terms of the data processing agreement before publication, and state the region here.]

Each client has a workspace, and isolation is enforced in the database, before the application sees a row. A query issued from one workspace cannot return a row belonging to another, because the policy is evaluated before the application ever sees the data.

There is exactly one exception, which is the Cortex operator role. It is the only privilege escalation in the system, and it is the thing we audit. Every action that role takes is written to an append only log. How the operator works is described in the method, and the firm behind it on the practice page.

Stored. Your company profile and onboarding answers, documents you upload, the findings and roadmap once published to you, workstream status, adoption metrics, and the schedule and status of interviews.

Never readable from your workspace. Interview transcripts, working files, unpublished findings, quantification in progress, our internal library, and anything belonging to another client. These are not hidden in the interface. They are unreachable by policy.

Never stored at all. Payment card details, which are handled by the payment provider and never touch our systems. And nothing from a Cortex engagement is used to train a model.

Transcripts. Call and interview transcripts are retained for the length of the engagement plus twelve months, then deleted. A passage marked off the record at the time is excluded from extraction and is never quotable. Transcripts are never readable from a client session at any point.

Backups. Point in time recovery is held for seven days, with a weekly file export and a monthly database dump to EU object storage.

Confidentiality terms are signed before kickoff, and cover everything said in an interview as well as everything written down. Every call and interview opens with a recorded consent line, and every interviewee receives a one page privacy notice beforehand.

At the end of an engagement, the client receives an export of their workspace. On request, everything is deleted within thirty days, transcripts included. Retention beyond that happens only where a client asks for it in writing.

Anyone who completed the Cortex AI Audit can have their answers, their report and their email address removed by replying to the report email with the word delete. It is done within thirty days.