Security overview
Understand how your data is handled
A practical overview of application behavior. For contractual commitments, review our privacy policy and contact us about your requirements.
Hosting and transport
Our deployment configuration targets AWS EC2 in us-east-1, with PostgreSQL behind nginx. Connections are served over HTTPS: TLS 1.2 and 1.3 are accepted, TLS 1.0 and 1.1 are refused, and plain HTTP redirects to HTTPS. Responses carry HSTS, nosniff, a referrer policy, and a restrictive permissions policy. Data is encrypted at rest: the volume holding the database is encrypted with an AWS-managed KMS key, and database backups are stored encrypted with AES-256. This describes the application deployment and its transport security, not a guarantee that every processor or backup stays in that region.
AI processing and review
Drafting and knowledge extraction send document text, questions, and knowledge-base content to third-party AI services. Drafting, classification, and document generation use Anthropic, OpenAI, and Groq, depending on the task and availability, and failover can send a request to another of those three. Google Gemini is used only by the free tools on this site, which run on what you type into them and never on your knowledge base. There is currently no customer-controlled provider restriction. Generated questionnaire answers require human review and approval; citations show provenance, not proof of truth. The AI evidence reviewer sends a control's requirement and the collected evidence values and summaries to the same providers — never integration credentials. Its reviews are advisory: they never change a control's status, and a person accepts or dismisses each one. Every AI call is logged with the model used and its token counts.
MCP access for your agents
Admins can create API tokens that let an AI agent read the workspace's compliance program through Korrali's MCP server: framework readiness, failing checks, tasks, controls with their evidence, knowledge-base facts, policies and the AI inventory. Tokens are read-only, shown once and stored only as a SHA-256 hash; they can be revoked at any time, are limited to 120 requests a minute, and every tool call is recorded in the workspace's audit log. Anything an agent reads is then processed under that agent's own provider terms.
Training and provider terms
Korrali does not use your knowledge base to train its own models. This statement does not describe third-party providers' training or retention practices. Those practices depend on the provider, service tier, and applicable agreement. Contact us to discuss processing requirements before uploading sensitive documentation.
Integrations and credentials
Connecting an integration is optional. Connectors make read operations to collect evidence from supported systems. Use credentials restricted to the permissions listed in the integration setup; a credential you supply may grant more permissions than the connector uses. Supported credential fields are encrypted with AES-256-GCM using an application environment key. On 17 September 2026 we audited the production database and found no integration credential stored in plaintext. That audit covers credentials in the database; it is not a statement about disk or backup encryption. The ongoing AWS connector currently uses access keys; the separate free AWS scanner uses role assumption.
Export, retention, and deletion
Questionnaire exports support PDF, DOCX, and Excel; supported spreadsheet imports can also be exported back into the buyer's workbook. These are questionnaire exports, not a complete account archive. Deletion of a workspace runs as a single reviewed operation that removes its documents, knowledge base, integrations, controls, vendors, audit log, and collected evidence, and is re-checked against the database afterward. Backups are a separate system: a snapshot taken before a deletion still contains those rows until it expires. The privacy policy describes retention and deletion commitments. Contact us for an account export or deletion request and for confirmation of backup handling applicable to your account.
Security questions and DPA requests
Security inquiries: security@korrali.com. Privacy, export, and deletion requests: privacy@korrali.com.
To request a DPA or discuss contract requirements, contact our team.