Usage, privacy, and security

CORA is designed to hold company knowledge and perform approved work, so permission and audit boundaries are part of the product rather than hidden infrastructure.

Usage

Customers see their AI usage in euros and as a percentage of what the period includes, with usage by product and an estimate of the work done. Token counts, model names and provider prices are not customer-facing. Deeper work, paid external tools and machine time use more than a simple chat.

Open Settings -> Usage to see the current period, additional usage with its history, automatic top-up and usage by product.

Workspace isolation

Company memory, documents, tasks, agents, integrations, and work items are scoped to a workspace. Application queries check the user and workspace explicitly, and database row-level security provides a backstop.

Personal profile settings and user memory follow the signed-in user, but they are kept separate from shared company memory.

Sensitive knowledge

Memory can carry sensitivity and visibility rules. Agents receive only context allowed for the current user's workspace role. Restricted information should not be widened by a normal member or copied into a less protected source.

Data sharing

Product improvement analytics and governed content contribution are on by default, with EU-only processing and with Flexible processing alike. Trial and free workspaces keep both settings on. Active paid plans can turn either setting off under Settings -> Data sharing. EU Strict, a contract lock for company workspaces, always keeps both settings off; the controls remain visible but disabled while the lock is set.

Data residency

Everything in CORA stays in the EU. Every workspace uses EU-only processing by default: persistently stored data stays in the EU, and AI processing uses approved EU routes and fails closed instead of falling back globally. CORA turns on Flexible processing, where approved AI inference may run globally under DPAs and SCCs, when the workspace owner asks in writing. In EU-only workspaces, background processing such as memory extraction, embeddings, OCR, and editor assistance uses EU Data Zone deployments, public web search runs through an EU-hosted search provider, and browser meetings, the chat microphone and Discord voice recordings are transcribed by Azure AI Speech in Sweden Central, and images are generated by an image model in the EU Data Zone. Managed mailboxes and Agent email run on Mailgun's EU region. Features without an approved EU route remain unavailable rather than being routed globally. Data residency remains owner-only and is not available through the generic conversational settings action.

Audit and approval

Agent tasks record their origin, executor, requester, reviewer, review time, status, steps, and results. State-changing actions should show the exact approved payload and verify their result. Narrow autonomy can be granted per executor only after the workspace is comfortable with observed behavior.