Cora

Trust Center

Cora is built for clinical research teams who handle sensitive study data every day. This page describes how we protect your data, ensure AI transparency, and maintain compliance readiness.

Data Handling

  • Zero Data Retention on AI/LLM Calls: All AI processing runs through AWS Bedrock with zero data retention enabled. Your queries and documents are never used to train models and are not stored by the AI provider after processing.
  • No Analytics, Cookies, or Behavioral Tracking: Cora does not use Google Analytics, tracking pixels, advertising cookies, or any behavioral tracking technology. We collect only what is necessary to operate the service.
  • PII Detection: Cora includes a built-in PII detector that screens queries for 18 HIPAA identifier types (names, dates of birth, medical record numbers, Social Security numbers, etc.). Queries containing detected PII are blocked before reaching the AI model.
  • Data Isolation: Each research site's data is logically isolated using PostgreSQL Row-Level Security (RLS). Users can only access documents and queries belonging to their assigned site.

AI Transparency

  • Retrieval-Augmented Generation (RAG): Cora does not generate answers from general knowledge. Every response is grounded in your uploaded study documents. Source citations with page numbers are included in every answer.
  • Grounding Verification: A secondary AI model (Claude Haiku) independently verifies that each answer is supported by the retrieved source chunks. Answers that fail grounding verification are flagged.
  • Confidence Scoring: Every response receives a confidence rating (HIGH, MEDIUM, or LOW) based on retrieval quality, grounding verification, and citation coverage.
  • LOW Confidence Warning: When confidence is LOW, Cora displays a prominent "Verify with your Principal Investigator" warning. This ensures clinical staff always exercise independent judgment.
  • Not a Medical Device: Cora is not designed, intended, or marketed as a clinical decision support system, medical device, or source of medical advice. It is a research and informational reference tool.

Infrastructure

  • Database: Supabase PostgreSQL with pgvector for vector similarity search. All data encrypted at rest (AES-256) and in transit (TLS 1.2+).
  • AI Processing: AWS Bedrock in the us-east-1 region. All inference calls use on-demand pricing with zero data retention.
  • Frontend Hosting: Vercel with automatic TLS certificate provisioning.
  • Backend Hosting: Railway with managed deployments and automatic TLS.
  • Multi-Tenancy: Row-Level Security (RLS) policies enforce data isolation at the database level. Every query validates the authenticated user's site membership before returning results.

Compliance Posture

  • Immutable Audit Logging: All document operations (upload, re-chunk, delete, version replacement) are recorded in an append-only document_audit_log table. UPDATE and DELETE operations on audit records are blocked by database triggers. This supports 21 CFR Part 11 audit trail requirements.
  • Session Timeout Enforcement: Inactive sessions are automatically terminated to prevent unauthorized access from unattended workstations.
  • Multi-Factor Authentication (MFA): TOTP-based MFA is supported for all user accounts, providing an additional layer of authentication security.
  • Role-Based Access Control: Three roles govern access -- owner_admin, admin, and member -- each with distinct permissions for document management, user administration, and site configuration.
  • Electronic Signatures: Terms of Service acceptance is recorded with the user's typed full name as an electronic signature, along with timestamp, IP address, user agent, and document version. These records are immutable.
  • Query Audit Trail: Every user query, AI response, confidence score, and response time is logged in query_audit_log for accountability and performance monitoring.

Contact

For security questions, vulnerability reports, or compliance inquiries, contact us at founders@maxoutput.ai.