Security & Architecture

Do you use customer data to train AI models?

Corply does not use customer data to train its own models. When a product feature invokes an AI provider, data is processed under the provider configuration and terms applicable to Corply's API account.

Which AI providers do you use?

Corply uses Google Vertex AI for AI features and OpenAI for embeddings used in retrieval. Features that read or summarize documents can send relevant company content to these providers. Your chosen AI client separately processes your conversation and information returned by Corply under its own terms and account settings.

What personal data do you store?

To form and maintain your company we store founder identity details, company information, formation and equity documents, tax and filing information, cap table data, and billing records. Access is limited to delivering and supporting the services you've requested.

Where is my data stored?

Application services run on Google Cloud. Structured company records are stored in managed PostgreSQL through Supabase, and canonical documents are stored in a private Google Cloud Storage bucket.

What exactly do you store?

• Company & founder data: legal names, addresses, ownership percentages, and roles used to prepare your filings.
• Formation documents: certificate of incorporation, bylaws, board and stockholder consents, stock purchase agreements, and 83(b) elections.
• Cap table & equity: shares issued, imported equity records, and vesting schedules.
• Payment and financial-product records: checkout status and provider references, plus account, transaction, wallet, or card data required for financial features you use.

What security measures do you have in place?

Corply's current technical controls include:

• Transport security: HTTPS/TLS for browser, API, and MCP traffic
• Access control: OAuth authentication, organization membership checks, and server-side authorization
• Database isolation: row-level security policies and restricted browser write access
• Document storage: private objects with time-limited signed download links
• Record integrity: hashes and event records for sensitive signing and evidence workflows
• Payment boundaries: payment and financial flows use dedicated server-side authorization and restrict browser access to sensitive values

How do you protect my legal documents?

Canonical documents are stored as private objects and downloaded through time-limited signed links. Signing and evidence workflows bind sensitive records to hashes and authorization state.

Do you publish an independent security audit or penetration-test report?

Corply has not published a completed independent security audit, SOC 2 report, or penetration-test report. The technical controls described here are Corply’s own disclosures, not independent assurance. Provider certifications do not certify Corply.

How do I report a security issue?

Email founders@0lumens.com with the affected surface and enough detail for us to investigate. Do not include passwords, private keys, full payment-card data, or taxpayer identifiers.

How do you handle data breaches?

If you report a suspected incident, Corply will assess it and respond based on its scope and applicable obligations.

Can I export my data?

Yes. Company owners, founders, and operators can choose Download records in Documents or Settings → Company → Export records. The ZIP contains available documents, an ownership CSV, company and leadership records, action status, deadlines, and a missing-file manifest. Individual founder documents remain limited to the entitled founder. Contact founders@0lumens.com if the archive reports unavailable files or exceeds its size limit.

Can I delete my data?

You can request account or data deletion at founders@0lumens.com. We will confirm what can be deleted and what must be retained for legal, security, payment, or company-record obligations.

Who can access my data?

Product access is limited by organization membership and server-side authorization. Authorized personnel and service providers may access data when needed to operate, secure, or support the service.

How long do you retain my data?

Corply retains records while needed to provide the service and meet legal, security, payment, and company-record obligations. Contact founders@0lumens.com for the current retention treatment applicable to a specific record or deletion request.

Where is my data processed?

Corply uses Google Cloud, Supabase, and the subprocessors listed below. Processing location can vary by provider and configuration; contact us if you need current location details for procurement or legal review.

Which core service providers do you use?

Core providers currently include the following. Contact founders@0lumens.com if you need the current full list for procurement or legal review.

• Google Cloud: application hosting, private document storage, and Vertex AI
• Supabase: authentication and managed PostgreSQL
• Finix: card payment processing for Corply Pay
• Payabli: U.S. bank (ACH) payment processing for Corply Pay
• Lithic: Corply Cards issuing and processing
• Stripe: payment processing for Corply's charges
• OpenAI: embeddings used for product retrieval
• Resend: transactional email delivery
• OpenSOSData: proposed company-name searches
• Google Analytics: website usage analytics

Where can I learn more?

For anything not covered here, reach us at founders@0lumens.com, or review our Terms of Use and Privacy Policy.