Privacy Policy

Korrali Trust ("Korrali", "we", "our") is operated by Korrali LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, United States. This policy explains what data we collect when you use trust.korrali.com.

• Account data: Name and email address when you sign up via Google OAuth or an email sign-in link.
• Your knowledge base: The security, compliance and product documentation you upload or enter — policies, control descriptions, prior questionnaire answers and supporting evidence. This is the substance of the product and is stored so it can be reused across questionnaires.
• Questionnaires you process: Files you upload for parsing, the questions extracted from them, and the answers generated or edited.
• Trust page content: Anything you choose to publish to a public trust page is, by design, publicly accessible.
• Billing data: Subscription state and payment records held by Stripe. We never see or store card numbers.
• Product analytics and errors: Usage events and crash reports, used to operate and improve the service.

Connectors use read operations. Restrict supplied credentials to the listed permissions; a credential may grant more permissions than the connector uses. Newly saved supported credential fields are encrypted by the application. You can revoke access by deleting the integration here or by revoking the credential at the source (rotating the token, deleting the IAM key or service account, etc.). Evidence refreshes hourly for as long as the integration stays connected.

GitHub / GitLab — a Personal or Group Access Token. What we read: organization/group 2FA requirement, branch protection rules, required pull/merge request reviews, CODEOWNERS files, Dependabot and secret-scanning status, and CI workflow/pipeline configuration. We do not read the contents of your source files.

Amazon Web Services — two separate connections. The free one-off scanner uses role assumption: you create an IAM role in your own account and give us its ARN and an external ID, and we assume that role for a single scan; nothing is stored afterwards. The ongoing integration currently asks for a read-only IAM access key ID and secret, stored so the hourly refresh can run unattended — we intend to move this to role assumption as well. What we read: IAM users, access keys, MFA devices and the account password policy; S3 bucket listings with their encryption and public-access status (never the contents of the objects); CloudTrail trails and their logging status; and GuardDuty detector configuration.

Google Cloud Platform — a service account key scoped to read-only roles. What we read: project IAM policy bindings, log export sink configuration, and GCS bucket listings with their public-access status (never the contents of the objects).

Microsoft Azure — an Entra ID app registration with a client secret, granted read-only roles on the subscription. What we read: subscription role assignments, storage account public-access and transport settings (never the contents of the blobs), Activity Log diagnostic-setting configuration, and Microsoft Defender for Cloud plan status.

Google Workspace — a service account key with domain-wide delegation, authorized for the Admin SDK Directory API's read-only user scope only, impersonating the admin account you designate. What we read: user 2-Step Verification enrollment, admin role assignment, and suspended-account status. We do not read email, files, or any other Workspace content.

Okta — an API token. What we read: MFA enrollment and password policy configuration, the count of Super Administrator role assignees, and the count of deprovisioned user accounts.

Rippling — an API token scoped to the employee directory. What we read: employee names, employment status, and start/termination dates, used only to evidence onboarding and offboarding timeliness for your own control dashboard. This is the most sensitive category of data any connector reads — treat this token with the same care as the others, and disconnect it if it is no longer needed.

Where a missing permission stops us reading something, or we sample rather than check every resource, we record that as unverified rather than as a pass. The dashboard shows which is which.

Generating answers requires sending relevant excerpts of your knowledge base and the questions being answered to third-party AI providers. Content leaves our infrastructure to reach them.

Depending on the task and which provider is available, your content may be sent to Anthropic, OpenAI, or Groq. A failover between them can happen without warning you, so treat all three as receiving your content. Google (Gemini) is not in this path: it is used only by the free tools on this site, which run on whatever you type into them rather than on your knowledge base.

Answers are grounded in your own knowledge base and cite the source they came from, rather than being generated freely. Generated answers are drafts for your review — you remain responsible for what you send to a customer or auditor.

If your security documentation is sensitive enough that third-party AI processing is unacceptable to you, this product is not a good fit, and we would rather you knew that before uploading anything.

• To parse questionnaires and draft answers from your knowledge base.
• To maintain your control dashboard and any trust page you publish.
• To authenticate you and manage your subscription.
• To monitor service health, diagnose failures and improve the product.

We do not sell your data, and we do not use your knowledge base to train our own models.

• Anthropic — AI answer generation and review.
• OpenAI — AI answer generation and review.
• Groq — AI answer generation, question classification, trial document generation, and free tools.
• Google (Gemini) — free tools only. Not used for answer generation, classification, or anything touching your knowledge base.
• GitHub — read-only posture checks against any GitHub organization you connect.
• GitLab — read-only posture checks against any GitLab group you connect.
• Amazon Web Services — read-only posture checks against any AWS account you connect.
• Google Cloud Platform — read-only posture checks against any GCP project you connect.
• Microsoft Azure — read-only posture checks against any Azure subscription you connect.
• Google Workspace — read-only posture checks against any Workspace domain you connect.
• Okta — read-only posture checks against any Okta org you connect.
• Rippling — read-only employee directory checks against any Rippling account you connect.
• Stripe — payments and subscription billing.
• Resend — transactional and sign-in email.
• Google — OAuth sign-in.
• PostHog — product analytics.
• Sentry — error and performance monitoring.
• Amazon Web Services — hosting and data storage.

Your knowledge base and questionnaire history are retained for as long as your account is active, because the product's value depends on reusing them. You can delete individual items at any time. On account deletion we remove your content from our live systems within 30 days, except where we must retain billing records to meet legal and tax obligations. Encrypted backups are expired on their own schedule rather than edited, so copies can persist in backups for up to 12 months, after which they are destroyed.

Data is encrypted in transit with TLS and at rest. Access to production systems is limited to personnel who need it to operate the service. No system is perfectly secure, and we will not pretend otherwise — if a breach affects your data we will tell you.

You may request access to, correction of, export of, or deletion of your data. Depending on where you live you may have additional rights under GDPR, UK GDPR or CCPA, including the right to object to processing and to lodge a complaint with your supervisory authority. Email us and we will action it.

If this policy changes materially we will update the effective date above and notify account holders by email.

Privacy questions: privacy@korrali.com · Security matters: security@korrali.com · Or write to: Korrali LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, USA.