Security and data boundaries

Security review should address the proposed deployment and workflow. The Coryntas Trust Center distinguishes current website controls from agent controls configured for each customer deployment.

Start with the deployment boundary#

Identify which systems, data categories, users, environments, and operations the workflow needs. Document what is excluded. The review should cover both the information used to prepare an answer and any action taken in another system.

Coryntas runs your runtime, web chat, and AI operations in a dedicated cloud environment. Use that deployment model as the starting point, then confirm the location, access controls, and data handling for your organization's architecture and workflow.

Review access and action controls#

Coryntas describes permission-aware context, scoped tools, approval boundaries, execution evidence, and controlled change as parts of its agent operating model. Confirm how those controls apply to your roles, systems, and decisions.

Include unauthorized access and denied actions in evaluation. Review the evidence and escalation path when a workflow encounters a boundary it cannot cross. See Prepare access and permissions.

Confirm data handling#

Ask your implementation and security teams to confirm where relevant data is processed and stored, what is retained, who has access, and which providers are involved. Requirements for sensitive data, deletion, and retention should be documented for the deployment.

The website's public-form retention period and your agent deployment's retention requirements are reviewed separately. Confirm the deployment location and any regional requirements with Coryntas before implementation, as described in Dedicated deployment. Review certifications and contractual commitments using the information supplied for your deployment.

Request security information#

Visit the Trust Center for public material. Its resources describe how to request architecture, data handling, deployment controls, and security questionnaire information.

Include the proposed systems, data categories, and workflow so the response can address the relevant boundary. Share sensitive evidence only through the agreed process. Use the Privacy Statement for the practices it specifically describes.