Data Processing Addendum

1. Definitions

“Data Protection Law” means all laws on personal data that apply to the processing, including the EU GDPR, the UK GDPR, India’s Digital Personal Data Protection Act, 2023, and the California Consumer Privacy Act, each as amended. “Customer Personal Data” means personal data that Cortex processes on behalf of Customer under the Terms. “Controller”, “processor”, “data subject”, “personal data breach” and “processing” have the meanings given in the GDPR, and include the equivalent terms (such as “data fiduciary” and “data principal”) in other Data Protection Law.

2. Roles

Customer is the controller of Customer Personal Data and Cortex is its processor. Each member’s personal Cortex account and brain is held by Cortex as controller under our Privacy Policy, not on Customer’s behalf, because it belongs to the member and leaves with them. Customer is responsible for having a lawful basis, and giving any notices, for the Customer Personal Data it provides.

3. Instructions

Cortex processes Customer Personal Data only on Customer’s documented instructions. The Terms, this Addendum, and Customer’s configuration of Cortex (including what its admins upload, connect, grant and delete) are those instructions. Cortex will tell Customer if it believes an instruction breaks Data Protection Law, and may process data otherwise only where the law requires it, telling Customer first unless the law forbids that.

4. Confidentiality

Cortex ensures that everyone it authorizes to process Customer Personal Data is bound by a duty of confidentiality, and limits access to those who need it to run, support or secure the service.

5. Subprocessors

Customer gives Cortex general authorization to use the subprocessors below. Cortex imposes data protection obligations on each one that are no less protective than this Addendum, and remains responsible for their performance.

• Supabase: database, authentication and file storage (Mumbai, India region)
• Vercel: application hosting and serverless functions (Mumbai, India region), and page performance metrics
• OpenAI: language models, embeddings, transcription and speech synthesis
• Anthropic: language models, used as a fallback when the primary model is unavailable
• ElevenLabs: voice cloning and speech synthesis, only if you create a voice clone
• Smallest.ai: voice cloning and speech synthesis, only if you create a voice clone
• Razorpay: payment processing and subscriptions
• Resend: account, security and billing emails
• Google: Google sign-in and read-only Google Calendar, only if you use them; Google Analytics for site usage
• Composio: read-only connections to third-party apps, only if you connect one through it
• Cloudflare: Turnstile bot check on public clones
• PostHog: product analytics and session recordings with form inputs masked
• Microsoft Clarity: site usage analytics
• FormSubmit: delivers waitlist form submissions to our inbox

Cortex will update this list and email Customer’s organization admins at least 30 days before a new subprocessor starts processing Customer Personal Data. Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, Customer may terminate the affected service and receive a refund of prepaid fees for the unused period.

6. Security

Cortex implements the technical and organizational measures in Annex 2, and may update them provided the overall level of protection does not decrease.

7. Personal data breaches

Cortex will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, likely consequences, and the measures taken or proposed. Cortex will update Customer as more becomes known and take reasonable steps to contain the breach.

8. Assistance

Taking into account the nature of the processing, Cortex will give Customer reasonable help to respond to data subject requests, and with data protection impact assessments, prior consultations with regulators, and breach notifications. If Cortex receives a request directly from a data subject about Customer Personal Data, it will pass it to Customer and not respond itself unless Customer authorizes it.

9. Deletion and return

When the services end, or on Customer’s written request, Cortex will at Customer’s choice return Customer Personal Data in a machine-readable format or delete it, within 30 days, unless the law requires Cortex to keep it. Deleting an organization deletes its company material. Data in backups is overwritten on the backup provider’s rotation schedule and is not restored into the live service.

10. Audits

Cortex will make available the information reasonably necessary to demonstrate compliance with this Addendum, including answers to security questionnaires. Cortex does not currently hold a SOC 2 or ISO 27001 report. Where Customer reasonably needs more, Customer may audit Cortex no more than once a year, on at least 30 days’ written notice, during business hours, at Customer’s cost, and subject to confidentiality, unless a regulator requires otherwise or a personal data breach has occurred.

11. International transfers

Customer Personal Data is stored in India. Some subprocessors process it in the United States and other countries. Where Data Protection Law requires a transfer mechanism, including for transfers from the EEA, UK or Switzerland to a country without an adequacy decision, the parties will put in place the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum where relevant) on Customer’s request, and those clauses will prevail over this Addendum if they conflict.

12. General

This Addendum lasts as long as Cortex processes Customer Personal Data. Each party’s liability under it is subject to the limitations in the Terms. If this Addendum conflicts with the Terms on the processing of Customer Personal Data, this Addendum prevails.

Annex 1. Details of processing

• Subject matter and nature: hosting, indexing, retrieving over and generating answers from company material and member brains, so members can query each other’s clones and the company’s knowledge.
• Duration: the term of the services, plus the deletion period in section 9.
• Data subjects: Customer’s employees and contractors who are organization members, and people named in material Customer uploads.
• Categories of data: names, work email addresses, job titles, documents and messages Customer uploads or connects, questions asked of clones inside the organization, and usage records.
• Special categories: none are intended. Customer should not upload special-category data unless it has a lawful basis and has told us.

Annex 2. Security measures

Infrastructure and encryption

• Data stored with Supabase and application functions run on Vercel, both in Mumbai, India.
• TLS for all traffic, with HTTP Strict Transport Security and a Content Security Policy on the web app.
• Encryption at rest of the database and file storage, provided by Supabase.
• OAuth tokens for connected accounts additionally encrypted by Cortex with AES-256-GCM.
• API keys stored only as SHA-256 hashes; passwords stored only as hashes by the authentication provider.

Access control and isolation

• Row-level security with owner-only policies on user data tables.
• The browser holds no database keys; privileged database access happens only server side.
• Every organization-scoped record is keyed to one organization, and cross-member access is authorized on organization membership and role.
• Material from connected accounts and devices is excluded from teammate and public answers by default.
• Optional two-factor sign-in by emailed one-time code; revocable API keys.
• Rate limiting on query endpoints and a bot check on public clones.

Operations

• Changes made to a user’s brain through Cortex support tooling are written to an append-only log the user can read in Settings.
• OpenAI chat requests are sent with storage switched off (store: false). Zero data retention agreements with OpenAI and Anthropic are not in place.
• Customer content is not used to train models.
• Automated checks before every release scan for secrets in client code and fail any database migration that creates a table without row-level security.
• Account deletion locks the account immediately and an hourly job permanently deletes its content 7 days later.

More detail is on our Security page.