Your book stays yours.
Lending runs on confidential information: credit agreements, financial statements, borrower files and the decisions made on them. CORA is built to keep all of it protected, controlled and traceable.
Independent assurance.
SOC 2 Type I
Completed. Report issued by an independent auditor.
SOC 2 Type II
In progress with an independent auditor.
Penetration tested
An independent penetration test, with all findings remediated.
Your data, protected.
Encrypted in transit and at rest
Agreements, statements, files and conversations, protected on the wire and in storage.
No training on your data
Your information does your work and nothing else. It is never used to train AI models.
Shared or dedicated
Run CORA in a shared cloud environment, or in one dedicated to your institution.
CORA works on your data. It never learns from it.
Control stays with your institution.
Who sees a deal, who can act on it and who signs is set by you, and each act is recorded with who did it and when.
Permissions and approvals
Role-based access, with each approval on a named person.
SSO and MFA
Single sign-on and multi-factor authentication for all users.
A full audit trail
Uploads, answers, approvals and signatures, with who did it and when.
A person decides
The model drafts. Anything that changes the record or reaches a borrower waits for a person.
Every answer traceable.
CORA states only what it can source. Each answer names the documents and clauses it came from, and each figure on the record traces back to the act that set it.
No source, no statement.
Questions.
How is our data protected?
All data on CORA is encrypted in transit and at rest. Access is limited to the people your institution grants it to, under the roles and approvals you set.
Is our data used to train AI models?
No. Your agreements, financials, files and answers are used to do your work and are never used to train AI models.
Who at our institution can see what?
You decide. Each person holds a role, approvals sit with named seats, and a deal's information is visible only to the people you give access to.
Can we run CORA in a dedicated environment?
Yes. CORA runs in a shared cloud environment or in one dedicated to your institution.
Where is CORA on SOC 2?
CORA has completed its SOC 2 Type I audit, and the report is available on request under a confidentiality agreement. SOC 2 Type II is in progress with an independent auditor. CORA has also completed an independent penetration test, with all findings remediated.
How do we report a security concern?
Write to security@coraabl.com. Concerns about conduct can be raised through the anonymous form linked at the foot of every page.
Questions for your security review?
Our team will take your security and risk teams through how CORA protects your data.