Trust Center

Trust, documented.

CORA's security, privacy and compliance materials in one place, and how your security and risk teams can request what a review needs.

Live control status, updated continuously, hosted by Vanta.

Compliance.

SOC 2Type I

Completed. Report issued by an independent auditor.

SOC 2Type II

In progress with an independent auditor.

Pen test

An independent penetration test, with all findings remediated.

Security overview
How CORA protects lending data, controls access and records each act.
PublicRead
Privacy policy
What information CORA collects, how it is used and shared, and your choices.
PublicRead
Terms of service
The terms that govern use of CORA's website and platform.
PublicRead
SOC 2 Type I report
The independent auditor's report. Shared under a confidentiality agreement.
On requestRequest
SOC 2 Type II report
The independent auditor's report, once issued. Shared under a confidentiality agreement.
On requestRequest
Named sub-processors
The current list of named providers, for customers under their agreement.
On requestRequest

CORA works with a limited number of service providers, each bound by a written agreement requiring confidentiality and appropriate security.

Category	What it does
Cloud infrastructure	Hosts the platform and stores customer data, in the United States.
AI model processing	Reads and drafts at the customer's direction; barred by contract from training on the data.
Website hosting and delivery	Serves coraabl.com and counts visits without cookies.
Email and productivity tools	Delivers platform notices and runs CORA's own work.
Source code hosting	Holds CORA's source code.

Customers may request the current named list under their agreement. Notice of provider changes follows that agreement.

Write to security@coraabl.com with what you found and how to reproduce it.

Write to whistleblower@coraabl.com, or use the anonymous form linked at the foot of the page.

Write to our security team and we will send what your review needs.