Client Data Security Commitment
How the Corduroy Vault protects your business data
Your business data is among your most sensitive assets. The Corduroy Vault is built to protect it with the same rigor applied to enterprise financial systems - not repurposed consumer tools.
A commitment you can verify
When you work with Corduroy, you are asked to share financial records, operational data, customer information, and strategic plans. We understand the weight of that request. This page explains exactly how the Corduroy Vault is designed to protect that information - and how its architecture compares to the tools most businesses currently use to store and share sensitive data.
We do not ask you to take our word for it. Every security measure described here is built into the technical architecture of the Vault - not policy alone, but enforced by the system itself. How we collect and use information is covered in our Privacy Policy.
The six pillars of Vault security
The Corduroy Vault is built on six foundational security principles, each implemented at the infrastructure level:
Per-Client Isolation
Your business data is provisioned into a dedicated, private S3 bucket. No shared folders. No shared databases. Your data cannot touch another client's - by design, not by policy.
Identity-Based Access Control
Access is governed by AWS Identity and Access Management (IAM) policies. Only authenticated Corduroy roles with explicit permissions can interact with your Vault.
End-to-End Encryption
All files are encrypted at rest using AES-256 and in transit using TLS 1.3. Encryption is always on - it is not a premium feature or an admin setting.
Immutable Audit Logging
Every action taken in the Vault - every upload, retrieval, and access event - is logged with a timestamp and actor identity. Logs cannot be altered or deleted.
AI Retrieval Firewall
AI models never touch your raw files. All queries are routed through a controlled retrieval service layer that returns only what is necessary for the task - nothing more.
Freshness Monitoring
Corduroy advisors monitor data completeness from a secure admin view, proactively identifying gaps and alerting when data may be stale - before it affects your plan.
Vault vs. traditional tools
The table below compares the Corduroy Vault directly against the tools most SMB leaders currently use to store and share sensitive business data: Google Drive, Dropbox, and email. The comparison is not meant to suggest that these tools have no legitimate uses - they are excellent for general collaboration. The point is that none of them were designed for the secure custody of sensitive business intelligence that will be used as the foundation for AI-driven analysis.
| Security feature | The Corduroy Vault | Google Drive, Dropbox & email |
|---|---|---|
| Data Isolation | Dedicated, per-client encrypted storage - your data is physically separated from all other clients | Shared infrastructure; data co-mingled with millions of other accounts |
| Access Control | IAM-enforced policies; only authorized Corduroy roles can access your bucket - no cross-client access possible | Folder-level permissions that can be overridden; admin access to entire org shared drive |
| Encryption at Rest | AES-256 encryption on all stored files, always on - no configuration required | Varies; often optional or dependent on account tier and admin settings |
| Encryption in Transit | TLS 1.3 enforced on all data transmission between client and Vault | HTTPS standard but attachments forwarded by email travel unprotected once forwarded |
| Audit Logging | Full immutable audit trail: every file access, upload, and retrieval logged with timestamp and actor | Basic activity logs; email has no structured audit trail whatsoever |
| Accidental Sharing | Strict access architecture - files cannot be shared, forwarded, or linked externally | One wrong Share click or reply-all exposes sensitive documents to unintended recipients |
| AI Retrieval Layer | LLMs access data only through a controlled retrieval service - never touch raw files directly | No equivalent; any AI tool plugged in can read entire Drive with broad permissions |
| Data Freshness Monitoring | Corduroy advisors monitor data completeness and flag gaps via admin dashboard | No structured monitoring; gaps go unnoticed until someone manually checks |
| Compliance-Ready Architecture | Designed from the ground up for enterprise-grade compliance; SOC 2 pathway built into architecture | Consumer-grade tools with compliance retrofitted; email is not compliant by default |
The tools you already use are built for collaboration. The Vault is built for custody. These are different design objectives - and the difference matters when the data involved is your most sensitive business intelligence.
Common scenarios, answered
What happens if a Corduroy employee leaves the company?
Access to the Vault is governed by role-based IAM policies, not individual account credentials. When a team member departs, their access is revoked immediately at the policy level - they retain no ability to access client data through any mechanism.
Can another Corduroy client see my data?
No. Each client is provisioned a dedicated, isolated S3 bucket with IAM policies that explicitly deny access from any other client context. Cross-client access is architecturally impossible, not merely prohibited by policy.
What does the AI actually see when it analyzes my data?
AI models interact with your data exclusively through Corduroy's retrieval service - a controlled API layer that returns only the specific context required to answer a query. AI models never have direct access to your raw files or your S3 bucket. This is a technical constraint, not an honor system.
Can I get my data back if I leave Corduroy?
Yes. Your data remains yours. Upon termination of the engagement, Corduroy will provide a full export of all files ingested into your Vault and will securely delete all copies from our systems, confirmed in writing.
What we commit to, ongoing
Security is not a one-time design decision. Corduroy commits to the following on an ongoing basis:
- Periodic audits. Regular internal security reviews of Vault architecture, access policies, and retrieval service logs.
- Incident notification. Notification within 72 hours of any confirmed security incident involving client data, with a full written incident report.
- Staff obligations. All Corduroy staff with access to client Vault environments undergo security training and are bound by confidentiality agreements.
- SOC 2 pathway. The Vault is designed to support SOC 2 Type II compliance as the platform matures. Clients will be notified when certification is achieved.
- Client transparency. Clients may request a written summary of their Vault's current data contents and access log at any time.
Statement of commitment
Corduroy Technologies acknowledges that the data entrusted to the Vault by each client is confidential, commercially sensitive, and subject to the highest standard of custodial care. The security architecture described here reflects that obligation - not as a marketing claim, but as a technical and operational commitment that can be examined, tested, and held to account.
Questions about the technical implementation of any security measure described here may be directed to the Corduroy engagement team. We welcome scrutiny and are prepared to walk through any aspect of the Vault architecture with your technical advisors or legal counsel.
Corduroy Technologies
privacy@corduroytech.ai