Security and data handling

Clio access is read-only

Corro reads your matters through Clio's API with read (GET) requests only. The Clio client in our code has no way to send anything else: any other kind of request is refused by the code before it leaves our server, and an automated test checks that refusal.

The one exception is signing in: connecting Clio exchanges a sign-in code for an access token with Clio's sign-in service. That exchange carries no case data.
Clio's access token for your firm is stored in your firm's own database in Corro.
Files you upload to Corro, and cases you create in Corro, stay in Corro. They are never sent to Clio.

Each firm's data is kept apart

Every firm has a database file and a folder of its own on our server, holding its cases, documents and page images. A signed-in request is tied to one firm, and the app opens only that firm's store for it. Firms do not share a database.

Reading by AI models

To read documents, notes and emails, Corro sends them to OpenAI's API. Questions you ask Cory, drafts you run through the checker, and text checked before a provider share or on a provider's reply go to the same API, with the parts of the file they need. You should know this before you connect a case.

Every request is sent with OpenAI's response storage turned off (store=false).
OpenAI states that data sent to its API is not used to train or improve its models unless the customer opts in. We have not opted in.
OpenAI may keep requests in abuse-monitoring logs for up to 30 days, and may keep flagged content longer for review. Our current agreement with OpenAI is its standard API terms, without zero data retention.
Arithmetic (totals, dates, balances) is done by our code, never by the model. Quotes the model extracts are matched against the source text by code before they are shown as matched.

Source for OpenAI's terms: OpenAI's "Your data" page, read 2026-10-02. Check it for the current wording.

Accounts and sign-in

Passwords are stored only as argon2id hashes.
Email verification links last 48 hours and password-reset links 1 hour. Both work once and are stored only as hashes.
Sessions are held on the server. The browser keeps only a cookie marked HttpOnly, Secure and SameSite=Lax, replaced with a new one at sign-in and whenever a session's access changes.
A session ends after 12 hours without use, and after 7 days at most.
Sign-in, sign-up, password reset and invitations are rate-limited by IP address and by email address.
Roles: owner, admin and member. Any user can sign out all of their own sessions; a password reset signs out every session of that user; removing a member ends their sessions.
Two-factor sign-in with an authenticator app is required before a firm's first client records are added.

Provider links

A provider sees a case only through a private link the firm creates for them. No account or password is involved, so treat the link as you would the records themselves.
The page shows only the categories the attorney switched on. Case strategy and internal notes cannot be switched on.
Each link shows a frozen snapshot of what the firm sent and stops working 30 days after it was sent. The firm can turn a link off sooner, and a log records what was shared and when the link was opened.
A provider link opens only that provider's view. It cannot reach the firm's side of the app.

Staff access

Our policy: Corro staff do not open your case files unless you ask us to, for support. If you ask us for help with a specific problem, we look only with your written permission and only at what the problem needs. A small team operates the servers that store your data; that access is used only to run and protect the service.

Encryption and backups

In transit. Every connection to the app and to this website uses HTTPS; a plain HTTP request is redirected to HTTPS first. The app tells browsers to use HTTPS only (HSTS).
At rest, and backups. Stored data and its backup copies are encrypted at rest by our hosting provider. The launch host is still being chosen; before launch this section will name it, with its region, how often backups are taken and how long they are kept. Until then we make no claim about those.

Who processes your data

Service	What it does for Corro	What it receives
Our hosting provider (named here before launch)	Hosts the app and its storage	Everything the app stores for your firm
OpenAI	Reads the file; answers Cory, the checker and the checks on provider shares	The text and page images being read, and your question or draft with the parts of the file it needs
Stripe	Takes payment	Billing contact and card details (entered on Stripe's page)
Resend	Sends account emails	Your email address and the message
Vercel	Hosts this website	Ordinary web requests to these pages; no case data

This website sets no cookies and loads no trackers or third-party scripts.

Your data and deletion

Your firm's data is yours. An owner can delete the firm and everything in it at any time from Settings; it is removed within 24 hours. If you cancel or take the refund, your cases stay readable, read-only, for 30 days in case you come back; after that they are permanently deleted. The sample case stays available. Deletion removes data from the live system; backup copies held by our hosting provider, encrypted at rest, can outlast it, and the security page will state for how long once the launch host is chosen.

What we do not claim

Corro does not claim HIPAA compliance, and we do not have a business associate agreement with OpenAI.
Corro has no SOC 2 report or other independent certification today.
The checker and Cory report what the file says. They do not establish what is true, and they are not legal advice.

Whether your firm needs any of the above for a given matter is a question for your own counsel. If you need something we do not have, write to us before you connect a case; we would rather tell you no than have you find out later.

Reporting a problem

If you find a security problem, write to contact@corro.live with enough detail to reproduce it. Please do not access other firms' data or disrupt the service while testing.