Privacy

Corpusmith is at Cypress, TX. Questions about this notice go to contact@corpusmith.com.

Firm files and the searchable copies we make of them are stored in Supabase, in the US East region. They are encrypted at rest and in transit. That storage is hosted on SOC 2 audited infrastructure. Corpusmith does not claim SOC 2 certification.

Each firm’s data is isolated from every other firm’s at the database level. Only our server can change that data.

To answer a question, we send the relevant passages to OpenAI’s API. When we index a file, we also send that file text to OpenAI to make a searchable embedding. We use OpenAI for this. We do not send those passages to Anthropic.

OpenAI does not train on business API data. OpenAI may retain requests for up to 30 days for abuse monitoring.

Answers cite the source file.

This website does not use analytics or session-recording tools. We do not use advertising cookies. Fonts are self-hosted with the site. They are built into the app and served from our host.

The contact form stores your name, job title, work email, company, company type, and the workflow you describe. The resources form stores your name, company, industry, project notes, and the email or phone number you give us. An account stores your email, a password hash, and your company name.

Sign-in uses an essential cookie named corpusmith_account_session. It is HttpOnly, lasts about 12 hours, and is marked Secure on the production site. A workspace may set a similar HttpOnly cookie so that firm can open its pages. A staff page may also set a cookie named staff.me, readable by the page, so the staff card remembers who you are. These cookies run the product. They are not used for ads.

The site is hosted on Vercel. Login and password-reset email is sent through Resend. Those hosts process the data needed to deliver the page or the message. We do not sell personal information.

Firm documents and the searchable copies of them are kept only while the firm is a customer.

Chat history is deleted automatically after 12 months. That deletion runs when the service handles a chat, and on a daily job when that job is turned on.

On request, or within 30 days after the contract ends, we delete all of that firm’s documents, files, and chat history. We confirm by email when that deletion is done.

OpenAI may keep the passages we send for up to 30 days for abuse monitoring. A copy may remain with OpenAI for up to 30 days after we delete it on our side. Deletion here is not an instant or complete removal from OpenAI.

Use of the workspace is also covered by our terms.