---
title: "AI Policy and Data Handling"
description: "How Corridor's AI features handle your data, what protections apply, and what you remain responsible for when acting on an AI answer."
---

<div style="padding: 14px 16px; border: 0.5px solid var(--corridor-purple-border); border-radius: 12px; background: var(--corridor-purple-soft); margin-bottom: 1.5rem;">
  <div style="display: flex; align-items: center; gap: 7px; margin-bottom: 8px;">
    <svg width="16" height="16" viewBox="0 0 16 16" fill="none">
      <path d="M9 2L4 9h4l-1 5 5-7H8l1-5z" stroke="var(--corridor-purple)" stroke-width="1.2" stroke-linecap="round" stroke-linejoin="round"/>
    </svg>
    <span style="font-size: 11px; font-weight: 500; letter-spacing: 0.05em; text-transform: uppercase; color: var(--corridor-purple);">TL;DR</span>
  </div>
  <div style="font-size: 13px; color: var(--sl-color-white); line-height: 1.65;">
    Corridor does not use your data to train or improve models, and each account's data stays isolated. CORRA answers only from objects your account can already read. You remain responsible for validating anything it produces before you act on it.
  </div>
</div>

## What this covers

This page summarizes how Corridor's AI features handle your data and what that means for you day to day. For a detailed review, refer to the [Corridor AI Policy](https://www.corridorplatforms.com/ai-policy).

## Your data is not used to train models

Corridor does not use customer data to train, retrain, or improve models. Data belonging to one account is isolated from every other account, so nothing you ask CORRA becomes training material or leaks into another customer's answers.

## How a request is handled

When you ask CORRA a question, three things happen in order:

1. The agent works out what it needs to answer you.
2. It retrieves only the platform data your account is permitted to read.
3. That material is sent to a third-party LLM, which generates the response.

Corridor supports LLM providers from OpenAI, Google, and Anthropic. Which one is in use depends on how your deployment is configured. See [Bringing Your Own LLM](/technology/ai/llm-providers/) if you need to point Corridor at your own provider or credentials.

## Access, encryption, and sessions

The platform's role-based access controls apply to AI requests exactly as they apply everywhere else. CORRA runs as you, so it cannot surface an object you would not be able to open yourself.

Traffic is encrypted in transit using TLS 1.2 or higher. Chat sessions are ephemeral and held in your browser's storage rather than being retained as a server-side record of your conversations.

## Compliance and safety

Corridor's practices meet SOC 2 standards. The AI features add their own safeguards on top: protection against prompt injection, validation on both inputs and outputs, and anomaly detection.

## What you stay responsible for

AI output is a starting point, not a verified result. Corridor does not guarantee the accuracy of what a model generates, so validate anything you intend to act on.

:::caution
AI output is subject to the same governance as any other change. A generated definition still has to be tested and approved before it can be used in production, and CORRA does not shortcut that path.
:::

The policy also prohibits using the AI features for anything illegal, for automated decisions that produce legal or similarly significant effects on a person without human involvement, or in a way that would breach the regulations you operate under.

## What's Next

- [CORRA AI](/user-guide/corra-ai/): what the assistant can help with, and how to get good answers
- [Corridor AI Policy](https://www.corridorplatforms.com/ai-policy): the full policy document
- [Input and Output Guardrails](/technology/ai/guardrails/): how access is controlled for agents