Trust Center
Frequently asked questions
Answers are limited to current public information. Deployment-specific questions are reviewed against the environment in scope.
What does this Trust Center cover?
It covers the current Coryntas website, the security and governance patterns used to design agent workflows, and the process for reviewing customer-specific deployment requirements. Customer agreements control where they are more specific.
Does Coryntas publish third-party certifications here?
No third-party certification is currently published in this Trust Center. Coryntas will add assurance material only after it has been formally approved for publication.
How does Coryntas protect public form submissions?
The Console enquiry API checks registered origins, validates and limits input, verifies self-hosted ALTCHA challenges, and rate limits requests. Partner applications use Cloudflare Turnstile. Service credentials remain on the server.
How long are website requests retained?
Business enquiries and their internal email jobs are retained for up to 12 months, with Console worker maintenance removing records after 365 days. Email correspondence associated with a business relationship may be kept longer as described in the Privacy Statement.
Does Coryntas use optional analytics?
Google Analytics 4 is added only after a visitor accepts optional analytics. Coryntas configures IP anonymization, denies advertising storage, and disables Google Signals.
Are deployment controls the same for every customer?
No. Identity, permissions, hosting boundaries, retention, approvals, integrations, and assurance requirements are confirmed for the systems and workflow in scope.
How can my team request architecture or data-flow information?
Email security@coryntas.com with the information your review requires and the systems or deployment you are evaluating. Coryntas will respond by email with information scoped to that review.
How do I report a security concern?
Email security@coryntas.com with a clear description and enough information to reproduce or assess the concern. Do not include passwords, access tokens, or unnecessary personal information.