Security and privacy

Your database and chat files are stored in Germany (EU). AI answers are made by Anthropic in the United States.

Every provider, what it does and where, is in the privacy policy.

Visitor answers, Draft with AI, rewrite and chat summaries use Claude Sonnet by Anthropic, on every plan. Claude Opus writes help article drafts, nudge ideas and popular question ideas. Neither Corner nor its AI providers train models on your content or your conversations.

The assistant that answers your visitors never sees files, file names or your private notes. Chat summaries you ask for do include your notes.

Corner reads your website with its own crawler, CornerBot, which follows your robots.txt and reads only the pages any visitor can open.

AI tools you connect yourself, such as Claude, ChatGPT or Cursor, handle what they read under their own terms. See AI tools you connect in the privacy policy.

• Files visitors send are encrypted (AES-256), checked for viruses, never given a public link, and photos lose their location data.
• Sign up and sign in on Corner's own pages are protected against bots with Cloudflare Turnstile.
• Two-step sign-in with an authenticator app, with backup codes, is available to every account in Account settings. Each sign-in, password change and change to who can access a workspace is recorded in a security log.
• The messenger loads only on your own domains, so a copied snippet doesn't work on another website.
• Web traffic reaches Corner's servers only through Cloudflare. The firewall turns away anything that tries to go around it.
• New chats are limited per visitor address: 5 an hour and 20 a day for each assistant, so one visitor can't use up your plan. Chats already going are never cut off, and blocked visitors cost nothing.
• The assistant is built to treat what visitors type as questions, not instructions, and not to reveal its rules.

Your own content stays until you delete it. Your visitors' data is deleted for good when its time is up, and you choose the time:

• Chats: 30 days to 3 years after the last message. The default is 1 year.
• Leads: 6 months to 3 years after they last changed. The default is 2 years.
• Files sent in chats: 30, 90 or 365 days. The default is 90 days.
• Visitors' IP addresses: cleared 90 days after they were recorded.

When someone asks you to delete their data, enter their email in Settings, Privacy: Corner finds their chats, files, leads and visitor records and deletes them all in one step. Deleting a workspace removes it from Corner at once and from backups within 30 days. To delete your personal account, or to use your GDPR, UK GDPR or California privacy rights, write to [email protected].

To help you with a problem, or to look into misuse of the service, Corner's team can open a support session in your account and see what you see. A session ends on its own after an hour, a banner shows while it's open, and the start of every session is recorded. We never see your password or card details.

For your visitors' data, you (the website owner) are in charge and Corner works for you. The contact card in the messenger asks visitors to agree before they send their details, in words you can change.

Please don't use the messenger for health details, card numbers or ID numbers. It isn't a source of medical, legal or financial advice.

What Corner doesn't have today, said plainly:

• No SOC 2 or ISO 27001 report.
• No public status page.
• No uptime promise (SLA).
• No single sign-on (SAML or SCIM).
• No published data processing agreement yet.

Found a security problem? Write to [email protected] with what you saw and how to see it again. Please don't look at other people's data or disrupt the service while you check.

Corner is run by Global Tech Stream LLC, 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, United States. Questions: [email protected]. More about the company: About Corner. Logos and facts for articles: press kit.