Trust Center
How we handle your data
What Coral Bricks stores, what it does not store, and the terms available to enterprise customers.
- GDPR & UK GDPRCovered
We sign a DPA incorporating the EU Standard Contractual Clauses, with the UK Addendum and Swiss amendments where they apply.
- CCPA / CPRAService provider
We do not sell or share customer data, and we do not use it outside our direct business relationship with you.
- SOC 2 Type II · ISO 27001 · HIPAAIn progress
All three are in their observation period and we expect to be certified soon. Each report, certificate or controls mapping goes to customers as soon as it is issued.
Overview
What we commit to.
We do not train on your prompts or completions
Every customer, every plan, no setting to turn on.
We offer zero data retention
Enabled for your organization, we do not persist your prompt or completion content.
Model training
Your content is never training data.
We do not use your prompts, your completions, or anything derived from them to train, fine-tune or distill any machine learning model. Not our models, and not any model run by anyone we work with.
This is unconditional. There is no toggle, no plan tier and no default that has to be changed. If we ever introduce an optional programme that uses customer content for model improvement, it will be strictly opt-in and covered by separate terms.
What we do use is aggregated operational data containing none of your content — total token volume, latency percentiles, error rates — to run and improve the service.
Zero data retention
An organization-level setting, enforced in the request path.
An owner turns it on from Data & Privacy in the dashboard, and it takes effect for every API key in the organization from that moment.
| What | Standard default | No content | No content + no metadata |
|---|---|---|---|
| Prompt and completion content, transcripts, tool-call arguments, and the model settings sent with them (temperature, thinking level) | Retained 30 days | Not retained | Not retained |
| Metadata — HTTP headers such as User-Agent and session IDs | Retained 45 days | Retained 45 days | Not retained |
| Operational data — model, endpoint, token counts, timings, status | Retained 45 days | Retained 45 days | Retained |
| Billing records — credits consumed, usage counts per endpoint | Retained | Retained | Retained |
Enforcement happens in the request path, not in a cleanup job: with zero data retention on, prompt and completion bodies are not written to our request logs, our database or our object storage. We verified this in production on 4 September 2026 by running a zero-data-retention organization and a control organization side by side, and confirming the first left no prompt or response bodies in storage while the control archived normally.
The difference between the two stricter levels is what survives alongside your content being gone. No content keeps the headers and counters we need to bill, debug and defend the service. No content + no metadata drops the headers too, leaving only the operational counters and the billing record — enough to invoice you and nothing that describes who was calling or how.
Three things worth knowing before you enable it
- It applies going forward. Turning it on does not delete content already stored; existing data ages out under the standard windows above. If you need existing data purged on a schedule, ask and we will handle it as part of your agreement.
- Stateful features stop working, by design. Server-side transcript chaining and per-request prompt history need stored content. Under zero data retention we refuse those requests rather than quietly store your content to serve them.
- Billing records are always kept. They are financial records and contain no message text.
Enterprise customers do not have to rely on a dashboard toggle. When we sign a DPA, the retention level for your organization becomes a term of the agreement.
Data handling
What we process, where, and how it is protected.
What we process
Whatever you put in a prompt, plus your account contact and billing details. We do not ask for special-category data. You decide whether to send it, and you are responsible for having a lawful basis if you do.
Where we process it
In any region where our infrastructure operates, including outside the United States. Transfers out of the EEA, the UK or Switzerland are covered by the Standard Contractual Clauses in our DPA. If you need processing pinned to a specific region, that is available on a dedicated deployment — talk to us.
Encryption
The inference API is served over TLS 1.2 or higher; older protocol versions are refused at the load balancer. Account and billing data is encrypted at rest with AES-256. Under zero data retention, your prompt and completion content is never at rest in the first place.
Security controls
Monitored continuously, not assembled at audit time.
We run a continuous-monitoring compliance programme covering 88 controls. Evidence is collected continuously rather than gathered the month before an audit. The full control list is part of our security questionnaire response.
Access control
Production access uses least-privilege roles and multi-factor authentication. No individual holds standing production permissions, access is reviewed on a schedule, and everyone with access is under a confidentiality obligation. Credentials and API keys live in a managed secrets store, never in source code.
Network security
Inference services run in private networks with deny-by-default firewall rules. Only the API gateway can reach them.
Personnel security and training
Background screening before access is granted, documented roles and responsibilities, policy acknowledgement at onboarding and periodically after, and security and privacy training relevant to each job function.
Risk assessment
A formal risk assessment runs annually against documented guidelines. Each risk is scored on likelihood and impact against the security, availability and confidentiality of the platform, and mapped to the controls that mitigate it. Fraud is assessed explicitly.
Third-party risk management
Anyone who processes data on our behalf is reviewed before use and reassessed annually, and their no-retention and no-training terms are kept on file.
Incident response
A documented process covers detection, containment, customer notice and post-incident review, with defined routes for both staff and customers to report a problem.
Continuous monitoring and internal audit
Control health is tracked continuously and reported to our Information Security Officer, who is formally assigned responsibility for the security and privacy programme.
Privacy
A published privacy notice, a defined route for data subject requests, and retention windows enforced automatically rather than by hand.
Incidents
What you get from us, and when.
- Breach notice within 72 hours. If a personal data breach affects your data we notify you without undue delay and within 72 hours of becoming aware, with what happened, what data was involved, the likely consequences and what we did. We keep updating you as facts come in.
- Data subject requests come to you. If a data subject contacts us about your data we forward the request and do not respond ourselves unless you authorise it. Under zero data retention these requests usually concern account data only.
- Annual questionnaires and audit rights. Once a year we answer security questionnaires in writing and provide a summary of our controls. After a breach, or if your regulator requires it, you can audit us directly.
Subprocessors
Disclosed in full under the DPA.
We use infrastructure to run inference, and a small number of services for sign-in, payments, analytics and customer communications. Every one of them is bound by written terms prohibiting training on your data, and by data-protection obligations substantially equivalent to the ones we give you.
The current subprocessor list, with each role and location, is an annex to the DPA and is available on request at privacy@coralbricks.ai. Under the DPA we give at least 10 days' notice before adding or replacing any subprocessor that handles prompts or completions, and you can object.
Our product analytics deliberately excludes prompt and completion content, personal identifiers, and anything revealing how a request was served.
Documents
Available to customers and prospects, most under NDA.
- Data Processing Addendum, ready to sign
- SOC 2 Type II report, once the auditor issues it
- Current subprocessor list
- Security questionnaire responses, including CAIQ-style questionnaires
- Summary of technical and organizational measures
Get a DPA signed
Written for exactly this situation.
You need "no storage of prompts and completions" and "no training on prompts and completions" in a signed agreement, because your own enterprise customers require it. That is what our DPA covers.
- Email privacy@coralbricks.ai with your legal entity name and the organization the agreement should cover. Tell us which retention level you need.
- We send the DPA, already covering zero data retention, no training, the Standard Contractual Clauses, 72-hour breach notice and the subprocessor annex.
- Redlines are fine. We turn them around rather than insisting on our paper.
- On execution we set your organization's retention level to match the agreement and confirm it in writing.
Most agreements close in days, not weeks. If your reviewers want a call before paper moves, book time with us.
Contact
Who to email.
Coral Bricks AI Inc.
Privacy, DPA requests and breach notices: privacy@coralbricks.ai
General: hello@coralbricks.ai
Reporting a vulnerability
Email privacy@coralbricks.ai with enough detail to reproduce. We will acknowledge, keep you updated, and will not pursue researchers acting in good faith who give us a reasonable chance to fix the issue before disclosing.