● CORRID · TRUST

Trust and Security at Corrid

Last updated 12 November 2026

Businesses trust Corrid with their suppliers, customers, costs and orders. This page describes how we protect that information and keep you in control. It is a summary of our practices, not a contract; our Terms of Service and Privacy Policy govern our commitments.

Data protection

  • Stored in Canada. Your Corrid database is stored in Canada. Some processing happens outside Canada, mainly in the United States, as our Privacy Policy explains.
  • Encrypted. Data is encrypted in transit and at rest, and credentials for connected accounts receive an additional layer of encryption.
  • Separated by business. Each business's data is kept separate, and access is checked on every request.
  • Yours to remove. You can delete items at any time, disconnect any account instantly, export your data, and close your account to have your data deleted within 31 days.
  • Never sold, never used for training. We don't sell your data, use it for advertising, or use it to train AI models.

Least access to your accounts

  • Corrid asks for the narrowest access each feature needs. For Google Drive, Corrid sees only the files you pick.
  • Corrid reads from your connected accounts. The one exception is a purchase order in Xero or QuickBooks, which Corrid creates only if you switch it on and approve that exact order.
  • You can disconnect any account from Corrid's Settings or from the provider's own settings, and we stop reading from it immediately.

Nothing binding without approval

  • Every message, order or commitment needs a person's approval of the exact action, inside Corrid.
  • Approval links are time-limited and tied to the exact text being approved.
  • Replies by email, text or chat can never approve anything, and instructions found inside emails or documents are never followed.

Access control

  • Your team. Roles and approval limits are set by your account's owner and enforced by Corrid, not only on screen. Changes to who can approve, and to approval limits, need extra confirmation and are reported to the owner.
  • Sign-in. Two-step sign-in is available to every user and recommended for owners and approvers. We email you when your account is signed in from a new browser, and you can sign out of every session at once.
  • Our staff. Access to production systems is limited to the people who need it and protected by multi-factor authentication. Corrid staff can help you with support, but they cannot approve, send, order or pay on your behalf. Staff access to a business's data is recorded.

Secure development and operations

  • We follow secure development practices, including automated security checks and dependency monitoring.
  • Email sent by Corrid is authenticated, so recipients' mail systems can confirm it really comes from us.
  • Every action in Corrid is recorded in an audit trail that your business's owners and approvers can export.

Availability and backups

  • We monitor Corrid and publish its current status at app.corrid.ai/status.
  • Backups are kept for a limited time and expire within 35 days.
  • We don't offer a service level agreement unless one is agreed in writing; see our Terms of Service.

Incident response

We maintain an incident response plan to contain, assess, notify and recover from security incidents. If a security incident creates a real risk of significant harm, we will notify affected customers and the Privacy Commissioner of Canada, and other authorities and people as the law requires in Canada and the United States, and tell you what happened and what we are doing about it.

Service providers

We use a small number of service providers to host and run Corrid. We review each before it handles customer data, give it only the data and access its service needs, and bind it by contract to protect that data. A current list of our service providers is available on request.

Reporting a security issue

If you believe you have found a security vulnerability in Corrid, please email hello@corrid.ai with the subject "Security", and include enough detail for us to reproduce it. Please give us reasonable time to fix it before sharing it publicly, and don't access or change other customers' data while testing. We won't pursue action against good-faith research that follows these guidelines.

Learn more

Security questions or requests for our security documentation: hello@corrid.ai.