Security
No recording. Stored in London. Plainly stated.
Corrobly never records a call and never stores audio. This page sets out where your data is, who processes it and how to reach us.
What we commit to
- No audio stored. Call audio is never recorded or stored, and no bot joins a call.
- No voiceprints or any other biometric identifiers: a speaker is named only by text a member types or chooses.
- Consent before any transcript. A live transcript starts only after the person running the call confirms everyone agreed, and that is logged.
- No training. Customer data is never used to train models, by us or our providers.
- Retention and deletion. Admins set how long raw notes and transcripts are kept, and calls, deals or the whole workspace can be deleted. Expert-network emails are never stored, and candidates nobody selects are deleted after 30 days.
Where your data is
All customer data is stored in London (UK). AI processing is done under no-training terms by Anthropic for analysis and Voyage AI for search, both in the United States, and, only when a member turns on a live transcript, by Deepgram for transcription in the European Union. EU processing can be discussed per customer.
Sub-processors
| Provider | Purpose | Location |
|---|---|---|
| Vercel | Application hosting and public-site analytics | London, UK for functions; global edge network for static files |
| Supabase | Postgres database and sign-in | London, UK |
| Anthropic | AI analysis of notes and documents | Outside the UK (United States) |
| Deepgram | Live transcription of call or meeting audio | Outside the UK (European Union) |
| Resend | Transactional email | Outside the UK (United States) |
| Cloudflare (Turnstile) | Bot check on sign-in and the waitlist form | Outside the UK (United States) |
| Voyage AI | Search embeddings for Ask Corrobly | Outside the UK (United States) |
Before a sub-processor is added, removed or changed, every workspace owner is emailed at least 30 days ahead, with the date it takes effect.
Certifications
Certifications held by our providers, as each publishes them.
| Provider | Attestation |
|---|---|
| Vercel | SOC 2 Type II, ISO 27001 |
| Supabase | SOC 2 Type II, ISO 27001 |
| Anthropic | SOC 2 Type II, ISO 27001 |
| Deepgram | SOC 2 Type II |
| Resend | SOC 2 Type II |
| Cloudflare | SOC 2 Type II, ISO 27001 |
| Voyage AI | See provider |
If something goes wrong
If a security incident affects your data, we contain it first, then tell your workspace owners and admins without undue delay, and within 48 hours, with what happened, what it touched and what we are doing, and we report to the ICO within 72 hours where the law requires it.
Security contact
Report a vulnerability or ask a security question at security@corrobly.com. We answer within two working days.
Our security pack, DPA, policies and GDPR documents are available on request.