# Privacy policy

What Cordanis collects, and what it does with it. Cordanis is an operating system for B2B sales teams. It works on data you bring to it and data you connect to it.

Effective October 31, 2026 · Applies to the Cordanis application at cordanis.com

## 01 What this covers

This policy applies to the Cordanis application and website at cordanis.com, operated by Cordanis. It covers the people who sign in to Cordanis (sellers, managers, and administrators at customer organizations) and the data those people bring into their workspace or connect through third-party sources.

Cordanis is used by organizations. If you use Cordanis through your employer, your employer is the customer and decides what data is connected, who can see it, and when it is deleted.

## 02 Information we process

- **Account data.** Name, work email address, organization. Authentication is Amazon Cognito; Cordanis never stores your password.
- **Workspace data.** Accounts, contacts, notes, research, documents, and messaging created or uploaded inside Cordanis. Dictation and meeting audio is turned into text and the audio is not kept; a meeting's transcript is saved under its account.
- **Connected source data.** Data read from services you choose to connect: Google Workspace (Gmail and Calendar), Microsoft Outlook, Salesforce, HubSpot, Zoho CRM, Slack, Granola, Apollo.
- Cordanis keeps an Assistant record for each Assistant request, and for each piece of background work such as a routine. The record holds what every AI model call was sent and answered and what every tool read or returned, with passwords, keys, and access tokens removed. It can hold the email, calendar, CRM, and document content the request used. It is stored in your organization's workspace on AWS, beside its conversation, and is used to show you what a run did and to investigate problems. A shorter list of each request's steps, which can include search terms and file names, is kept in our database and our AWS storage. Section 07 says how long each is kept.
- **Usage and operational data.** Request logs, run events, errors, timing. Operational logs carry identifiers, status, and timestamps, and do not contain message bodies, file contents, prompts, tokens, or credentials.

Cordanis does not use advertising trackers on the application and does not sell personal information.

## 03 Google user data

Scopes requested and what they are used for:

| Scope | Use |
| --- | --- |
| gmail.readonly | Find replies, detect threads waiting on you, give the Assistant the context of a conversation you ask about. |
| gmail.send | Send messages you reviewed and approved in Cordanis, from your own email address. Nothing is sent without your approval of that message. Cordanis does not read or change your drafts. |
| calendar.events.owned | Show upcoming meetings and prepare briefs for external meetings. Send, move, or cancel an invite on your own calendar only when you approve it. |
| calendar.events.freebusy | Find times when you and the teammates you name are free, without seeing what the meetings are. |

- Google user data is used only to provide and improve the features you see in the product for your own use. It is not used for advertising, not sold, and not transferred to third parties except to provide the service (the AWS infrastructure it runs on, including its web search, and the AI model providers named in sections 05 and 06), to comply with law, or with your explicit consent.
- People at Cordanis do not read your Gmail or Calendar data, except where Google permits: you send a feedback report that includes a request, a bug or abuse must be investigated, the law requires it, or the data is aggregated and anonymized. Each time someone at Cordanis opens a request to investigate, it is logged.
- Cordanis does not use Google user data to train AI or ML models, and does not send it to an AI model whose provider's terms allow training on it. When you ask the Assistant about an email or a meeting, or Cordanis prepares a meeting brief, the Gmail or Calendar content that work needs is sent to the AI model doing it, on Amazon Bedrock or through Vercel AI Gateway. Every request through Vercel asks it to use only providers that do not train on prompts. Section 05 names each company.
- When you press "Look it up" on a meeting guest the brief could not place, Cordanis searches the web for that person's name and company with the web search in our AWS environment. Nothing else from your calendar goes with it, and it is never sent to Parallel, the research search company in section 06.
- Access and refresh tokens are held in an encrypted credential vault inside our AWS environment (Amazon Bedrock AgentCore Identity), scoped to your user. They are never logged, never sent to the browser, and never exposed to the language model.
- Cordanis may read on your behalf while you are away (for example, preparing your daily plan before you sign in), using the same grant you gave when you connected, acting only as you, logged as runs you can inspect.
- Revoke at any time from your Google Account security settings or by disconnecting Google in Cordanis.

Cordanis' use and transfer to any other app of information received from Google APIs will adhere to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

## 04 Other connected sources

- Microsoft Outlook is read with your own Microsoft login to find replies and show your meetings. A message is sent or an invite changed only after you approve it.
- Salesforce, HubSpot, and Zoho CRM are read with your own login and permissions. Cordanis writes to your CRM only with your approval: a specific change you approve, or, when your administrator allows it, your own switch to log your email to the CRM. Each logged email waits ten minutes with an Undo before it is written.
- Slack is searched and read with your own Slack login when you ask about a conversation. Cordanis sees only what you can already see.
- Granola is connected at the organization level by an administrator. Meeting notes and transcripts are read into their accounts.
- **Apollo.** Connected at the organization level by an administrator; actions that spend credits require approval.
- **Web search.** Public results for account research, through the search companies in section 06; no workspace personal data is sent as a query without your instruction.

Each connected source uses least-privilege scopes and can be disconnected or revoked at the provider. Connected providers process your data under their own terms when called on your behalf.

## 05 How AI processing works

- Cordanis does not train models on your data, and it sends AI requests only to providers whose published terms say they do not train on them either. Its AI features run on models from Anthropic and OpenAI, through Amazon Bedrock inside our AWS environment or through Vercel AI Gateway. Through Vercel, a Claude request is served by Anthropic, Amazon Bedrock, Google Vertex AI, or Claude Platform on AWS, and a GPT request by OpenAI, Microsoft Azure, or Amazon Bedrock. Every request through Vercel asks it to use only providers that do not train on prompts, and fails rather than go to one that might.
- By default, the Assistant and its background work (routines, account summaries, the organization profile) run on Claude Sonnet 5.5 through Vercel. Meeting briefs and reading facts out of transcripts, documents, and records use Claude through Vercel.
- When an account is added, OpenAI's GPT reads the company's own website and public job postings and writes its profile, through Vercel. When that read leaves your organization's questions unanswered, it also searches the web through Parallel. If a profile cannot be written that way, a shorter one is written by Claude Haiku 4.5 on Amazon Bedrock. Once for each organization, Claude Opus 5.5 plans what research should look for, through Vercel. A research brief on request uses GPT to gather public sources and Claude to write it, through Vercel. Finding a company's website and a person's title use Claude through Vercel.
- Voice dictation and meeting recordings are turned into text by OpenAI. Cordanis sends the audio, and for a meeting the names of the account and its people. The audio is not kept by Cordanis.
- Published terms: Vercel says AI Gateway does not use prompts or responses for training and deletes them once a request is completed; it keeps each request's metadata, such as the model, the provider, and the tokens used, for 30 days. Anthropic's commercial terms say it may not train models on customer content. OpenAI says API data is not used to train its models unless the customer opts in, and that it keeps abuse monitoring logs of API requests for up to 30 days; transcription audio is not kept in those logs. Amazon says Bedrock content is not used to train models and is not shared with model providers. Vercel's list of providers that do not train on prompts includes Anthropic, Amazon Bedrock, Google Vertex AI, Claude Platform on AWS, OpenAI, and Microsoft Azure.
- An administrator can turn on more models, and each is off until turned on. They include other Claude and GPT models and models from Z.ai (GLM), Meta (Muse Spark), and Alibaba (Qwen). They run on Amazon Bedrock or through Vercel under the same rule: only providers that do not train on prompts.
- The Assistant's general toolbelt is read-only. Actions with outside effects run only after a person confirms them, or under a standing switch that person turned on, such as logging their email to the CRM.
- Every tool call produces an inspectable run event.

## 06 Storage, security, and subprocessors

- Private, tenant-scoped storage on AWS in the United States, encrypted in transit and at rest.
- Production access limited to engineers who operate the service, under individual credentials and audit logging.
- Subprocessors are the companies Cordanis chooses to help run the service; each receives only what its job needs. The providers you connect (section 04) process your data under their own terms.

| Subprocessor | What it receives, and why |
| --- | --- |
| Amazon Web Services | All customer data. Hosting, storage, database, sign-in (Amazon Cognito), credential vault, AI models on Amazon Bedrock, and web search: every search the Assistant runs, a meeting guest's role, and research searches when Parallel is not used. |
| Vercel (AI Gateway) | The text of each AI request it carries: your messages to the Assistant and the email, calendar, account, contact, document, and transcript content the work needs. |
| Anthropic, Google Vertex AI, Claude Platform on AWS | Requests to Claude models that Vercel sends to them. |
| OpenAI, Microsoft Azure | Requests to GPT models that Vercel sends to them. OpenAI also receives dictation and meeting audio, with the meeting's account and people names, to turn it into text. |
| Parallel | Research searches only: an account's name or website and what is being looked for. No email, calendar, or contact data is sent to Parallel. Parallel's customer terms allow it to use the searches it receives to train and improve its own models. |
| treg | When you ask for a contact's work email address or mobile number: the contact's name and company website, or their LinkedIn profile link. treg passes it first to Apollo. For an email address it goes to the email-finding companies on treg's route, which on October 31, 2026 were AI Ark, Anymailfinder, Aviato, BlitzAPI, ContactOut, Datagma, Dropcontact, Dropleads, Enrow, Fiber AI, Findymail, Hunter, LeadMagic, LeadsForge, LimaData, Moltsets, Prospeo, QuickEnrich, Sixtyfour, Tomba, TryKitt, and Wiza. For a mobile number it goes to BlitzAPI, QuickEnrich, AI Ark, Tomba, Wiza, Prospeo, and ContactOut, in that order, and then to Trestle, which checks the number against the person's name. |
| Stripe | Payments: the buyer's email address, what is bought, and internal ids. Card details are entered on Stripe's own page; Cordanis never sees the card number. |
| Resend | Emails Cordanis sends. Invitations and ownership changes: the recipient's email address, the organization's name, and the inviter's name. Feedback reports: your name, company, and report to Cordanis, and the thank-you reply with your report to your email address. Waitlist requests: the name, work email address, company, and form answers, to Cordanis. |
| Google (favicon service) | An account's website, to show the company's logo. |
| PostHog | Website and product analytics. No names and no email addresses. |

- Cordanis also reads public web pages, such as an account's own website, the public job board it links to, and pages a web search found. Those requests carry only the page's web address.
- Website analytics: public pages and the sign-up and sign-in pages are counted with PostHog, without cookies and without storing anything in your browser. Of a page's web address only the page and a post's campaign tags are sent; no email address, invitation link, ad click id, or name is sent. It does not run on invitation pages.
- Product analytics: inside the application, PostHog shows which first-run steps are finished, which screens are used, where clicks do nothing, and which errors appear. You are known by a code made from your user id, never your name or email address. Session replays mask every piece of text and everything typed, and leave out images. Named events carry kinds and counts, never content. It is used only to improve Cordanis and is never shown to your employer.
- Full security controls: [Trust & controls](/trust).

## 07 Retention and deletion

- Workspace data is kept while the organization's account is active, and deleted within 30 days of closure unless law requires longer.
- Cordanis does not copy your mailbox or calendar into its own storage. It keeps message details and derived signals for the daily plan and meeting details for briefs. Message content is kept only where a feature used it: in an Assistant conversation and its record when you asked about a message, in a meeting brief, or in an account's notes.
- Assistant conversations and their records are kept while the organization's account is active. Archiving a conversation hides it but does not delete it or its record. To have them deleted sooner, write to the email address below. The shorter list of each request's steps is deleted after 90 days.
- Disconnecting or revoking stops all further reads immediately; on request, previously read data is deleted.
- Operational logs are kept for 90 days.

## 08 Your choices

- Disconnect any source from Settings.
- Revoke Google access at [myaccount.google.com/permissions](https://myaccount.google.com/permissions).
- Ask for export or deletion at the email address below; we answer within 30 days.

## 09 Changes to this policy

The effective date changes with the policy, and previous versions are available on request. Material changes to how connected source data is used are announced to organization administrators before they take effect.

October 31, 2026: This version names each company Cordanis uses that receives customer data, and what each one receives. The version effective September 20, 2026 said AI ran only through Amazon Bedrock and named only Amazon Web Services and PostHog as subprocessors. That was incomplete: some AI features already ran through Vercel AI Gateway on Anthropic and OpenAI models, dictation and meeting audio already went to OpenAI, and web search, contact data, payments, and emails already used Parallel, treg, Stripe, and Resend. It also said operational data never held prompts or message content, and Cordanis keeps the Assistant records described in sections 02 and 07. With this version, Cordanis also stopped sending a meeting guest's name and company to Parallel, made every request through Vercel ask for providers that do not train on prompts, and removed an optional model, Meta's Muse Spark 1.3 Contributor, whose terms let Meta train on what it is sent.

## 10 Contact

support@cordanis.com