# Obi Trust & Security: SOC 2 Type II & Data Controls | Cor

> See how Cor protects customer data with SOC 2 Type II controls, configurable retention, Privacy Mode, user-controlled sessions and enterprise security documentation.

URL: https://getcor.ai/trust-security

SOC 2 Type 2, granular privacy, retention, and access controls - governance built into Cor from day one.

## Hero - Obi works with your customers. We take that responsibility seriously.

Enterprise-grade security, privacy controls and data protection built for customer-facing AI.

## Trust badges

- **SOC 2 Type II** 
- **Privacy Mode** 
- **User Consent** 

## SOC 2 Type II

Cor has completed SOC 2 Type II examination. Our latest report and bridge letter are available on request.

- **Full SOC 2 Type II report available to customers and prospects under NDA.** 
- **Full subprocessor list available upon request.** 
- **Security review calls and completed customer security questionnaires on request.** 

## The dials are yours. Privacy, redaction, retention.

- **Privacy Mode.** Use Obi without retaining screen recordings. Screen content is processed in real time while a user is actively sharing, but is not retained by Cor after the session.
- **Data protection.** Customer data is encrypted in transit and at rest. Retention periods can be configured for each agent, and customers can delete their session data themselves at any time.
- **Your data stays your data.** We do not use customer data to train our models or third-party AI models. You control what information is provided to Obi. Product login credentials are not required, and customers can use non-identifying user IDs where appropriate.

## Your customers stay in control.

- **1. Choose what to share.** The browser asks the user what to share before Obi can see their screen. Sharing only begins when they choose and can be stopped at any time.
- **2. Share only one tab.** The user can select just the Fieldbook tab. Obi sees only the tab they choose, not other tabs or their webcam.
- **3. Voice input is optional.** Users can turn voice off and continue the session with Obi in chat.

## Trust & Security FAQs

### Is the SOC 2 Type 2 report available?

Yes. We provide the full report under NDA to enterprise prospects and customers. Simply request it on your demo call or contact us directly at team@getcor.ai.

### Does Cor store raw screen content permanently?

No. Screen content is processed in real-time during the session. We only store the structured output - the transcript, the report, and the video recording (if enabled).

### How does your PII redaction work?

Cor runs automated detection across session transcripts before storage. Common sensitive patterns - names, emails, phone numbers, financial identifiers - are identified and replaced with placeholders. The original data is not saved.

### What happens if a customer revokes consent mid-session?

The session ends immediately, and no further data is captured. Any data captured prior to that moment follows your account's standard retention policy.

### How are full audit trails of every session delivered?

Every session is logged in Admin Hub - the transcript, the structured report, and (when enabled) the recording are captured against the user, account, and timestamp. Your team can review or export those logs at any time, giving security and compliance the full audit trail they need.

### Do you use third-party subprocessors?

Yes. A list of our subprocessors is available upon request.

### What happens to our data if we cancel?

All session data is permanently deleted within 30 days of account closure. We are happy to provide written confirmation of this deletion upon request.

## Bottom CTA

Everything your security team needs. Access our SOC 2 documentation, DPA, subprocessor information, security policies and other due diligence materials through our Trust Center.