Built for the data legal and compliance teams can't afford to leak.
Corpflow is the system of record for entity portfolios — UBOs, directors, registers, source documents. We treat that data the way the teams who own it have to: encrypted, isolated, audited, and reviewable.
Where your data lives — and who runs the racks.
Corpflow runs on a small set of named providers, each holding SOC 2 (and, in most cases, ISO 27001). We don't operate our own data centers; we lean on the cloud providers your IT team probably already trusts.
The controls behind every record and every document.
What we keep, where we keep it, and how it leaves.
Tenant isolation. Every record in Corpflow is scoped to an organization. Application-level access controls enforce that scoping on every read and write — there is no cross-tenant query path in the product.
Soft delete & retention. Account and entity data are soft-deleted on request and may be permanently deleted on customer instruction. Documents are retained until you or your administrator delete them, or until your account is terminated.
Backup & recovery. The database runs on MongoDB Atlas with continuous backups and point-in-time recovery. Document storage benefits from AWS’ durability guarantees.
AI features. When you use AI-assisted parsing or extraction, relevant document content is sent to OpenAI and/or Anthropic for processing under their enterprise data terms. Your data is not used to train their models.
For the full picture of what we collect, retain, and share, see the Privacy Policy.
The third parties that touch customer data.
We keep this list short on purpose. Each provider below holds its own privacy commitments and is bound by a data processing agreement with Corpflow.
Found something? We want to hear from you.
If you believe you've found a security vulnerability in Corpflow, please report it to security@corpflow.ai. We'll acknowledge your report within two business days and keep you updated as we triage and remediate.
Please give us a reasonable window to fix the issue before disclosing it publicly. We do not pursue legal action against researchers who act in good faith and follow this process.
Need a deeper look before bringing us to security review?
We'll happily share our security overview, subprocessor list, and answers to your team's SIG / CAIQ questionnaire. Most reviews close in under a week.