On this page
Corvio must process the content you ask it to use
To store, search, retrieve, or edit your work, authorized services need to read the relevant documents, prompts, answers, and attachments. Ordinary Workspace content is not end-to-end encrypted.
Public connections use HTTPS encryption. Notes and files are stored by managed cloud services; storage encryption, keys and backup controls must be verified against each deployed resource. Encrypted transport does not prevent authorized services from processing content when a feature requires it.
Corvio staff cannot browse your work by default
Normal support and operations screens show metadata such as IDs, status, timing, model, token counts, and error codes—not document text, prompts, or AI answers.
When a content read is genuinely needed, an authorized staff member must use a separate, short-lived, read-only session tied to the person, Workspace, reason, and end time. Allowed and denied reads are audited. During the staged rollout, necessary reads not yet hard-gated by Support Access are labeled as transition exceptions; the linked Support Access article explains this boundary and emergency access.
We publish only security claims we can verify
Public service connections use HTTPS, and notes and files reside in managed storage. We do not turn provider defaults into product promises: storage encryption coverage, exact algorithms, protocol versions, regions, key ownership, and retention windows are published only after the deployed control has been verified.
No online service can promise absolute security. Corvio uses layered technical and organizational controls and reviews them as the system changes.