> ## Documentation Index
> Fetch the complete documentation index at: https://docs.corsa.finance/llms.txt
> Use this file to discover all available pages before exploring further.

# Security at Corsa - Trust Center & Security Overview

> How Corsa protects customer data, meets compliance standards, and secures AI-powered compliance features for regulated institutions.

Corsa handles some of the most sensitive data in financial services: customer identities, transaction histories, risk assessments, and regulatory filings. Our security posture is designed for regulated institutions and continuously evolves to meet the rigorous standards of the global financial industry.

We are open about our security design so that customers, auditors, and prospects can evaluate it with confidence.

## Compliance & Accreditations

Corsa is independently audited and compliant with industry-recognized standards. These validate that our controls are not only designed properly but operating effectively over time.

<Columns cols={2}>
  <Card title="SOC 2 Type II" icon="shield-check" href="/security/compliance-and-certifications">
    Security, availability, and confidentiality controls audited over a sustained observation period by an independent third-party.
  </Card>

  <Card title="GDPR" icon="flag" href="/security/compliance-and-certifications#data-privacy">
    Compliant with EU data protection regulation.
  </Card>
</Columns>

## Security by Design

Security isn't a feature we added - it's the foundation every component is built on. These principles guide every product decision, infrastructure change, and operational process.

<Columns cols={2}>
  <Card title="Tenant Isolation" icon="lock">
    Every customer's data is fully segregated. There is no cross-tenant data access, by design.
  </Card>

  <Card title="Encryption Everywhere" icon="key">
    Data encrypted at rest (AES-256) and in transit (TLS 1.2+). Customers can hold their own encryption keys via [HYOK](/hyok/index).
  </Card>

  <Card title="Zero-Trust Access" icon="fingerprint">
    Least-privilege enforcement across all internal systems. Employees authenticate via SSO with hardware-based MFA. Access to production requires additional approval and is time-boxed.
  </Card>

  <Card title="Private Connectivity" icon="network-wired">
    Private network connectivity available for enterprises that require all traffic to stay off the public internet.
  </Card>

  <Card title="Audit Trail" icon="clock-rotate-left">
    Every action in the platform is logged with full context - who, what, when, and why. Audit logs are retained according to regulatory requirements.
  </Card>
</Columns>

## Deep Dives

<Columns cols={2}>
  <Card title="Compliance & Certifications" icon="certificate" href="/security/compliance-and-certifications">
    SOC 2 Type II, GDPR, and our audit controls in detail.
  </Card>

  <Card title="Infrastructure Security" icon="server" href="/security/infrastructure">
    Network architecture, encryption, secrets management, vulnerability management, and incident response.
  </Card>

  <Card title="Product Security" icon="shield-halved" href="/security/product-security">
    Authentication, access control, API key management, SSO, and audit logs.
  </Card>

  <Card title="Custom sending domain" icon="envelope" href="/security/custom-sending-domain">
    Authenticate your domain so notification emails are sent from your brand.
  </Card>

  <Card title="AI Security" icon="brain-circuit" href="/security/ai-security">
    Privately hosted models, opt-in controls, PII guardrails, HYOK data protection, and strict data training policies.
  </Card>
</Columns>

## Employee Security

Security is every employee's responsibility - not just the security team's.

* **Security training** - All employees complete annual security education. Engineers complete additional secure software development training.
* **Phishing resilience** - Internal phishing campaigns test and train employees on recognizing social engineering attempts.
* **Secure development lifecycle** - Security experts are embedded early in the project lifecycle. Threat models and trust boundaries are established before implementation begins. All code changes go through peer review and automated security scanning.

## Responsible Disclosure

We maintain a [vulnerability disclosure program](/security/responsible-disclosure) and welcome reports from independent security researchers. We engage third-party firms for regular penetration testing and publish remediation timelines.

## Request Our Security Package

Customers and prospects can request Corsa's full security documentation, including:

* SOC 2 Type II report
* Penetration test executive summary
* Sub-processor list
* Security questionnaire responses

Contact your account manager or email [support@corsa.finance](mailto:support@corsa.finance).

***

Evaluating Corsa for your organization? [Schedule a demo](https://calendly.com/michellelatzer/welcome-to-corsa) or visit [corsa.finance](https://corsa.finance) to learn more about the platform.