How we handle
your data, your access, your trust.
Honest about where we are. Specific about how we got there. This page is updated as the program matures — last reviewed June 2026.
Compliance framework, in progress.
co5 is a pre-Series-A company in closed beta. We're operating to SOC 2 Type II controls today and pursuing formal certification in alignment with first-customer commitments. We'd rather tell you the truth about our timeline than chase a logo.
Encrypted both ways. Backed up. Recoverable.
Everything moves over TLS 1.3 (TLS 1.2 minimum). Postgres volumes encrypted at rest with AES-256. Daily snapshots retained 30 days, weekly retained 12 months. Disaster-recovery procedures tested quarterly. No customer data leaves our managed infrastructure for analytics or training.
The vendors behind the platform.
We deliberately stack on vendors with mature security programs — every sub-processor below is independently SOC 2 attested. Full list maintained on request; any new vendor that touches customer data is reviewed before onboarding and added here with notice.
Workspace isolation by default.
Every organization is a separately scoped tenant. Cross-tenant queries are blocked at the database layer, not just the application. Our internal access to customer data is role-gated, logged, and reviewed quarterly. Production access requires MFA + named-purpose justification.
Export it. Delete it. Take it with you.
If you close your account, your data is purged within 30 days — including backups within 90. Carol's memory is operator-curated and exportable as JSON at any time (you'll find this under Settings → Memory in the product). We don't share customer data with third parties, don't sell it, don't reuse it for marketing.
Detection, response, and notification.
The platform has internal self-healing for known failure modes (watchdogs, auto-remediation, audit trails — all documented in our architecture docs). For security incidents, our policy is to notify affected customers within 72 hours of confirmed impact, with a written post-mortem within 14 days. We run continuous monitoring on auth events, anomalous API patterns, and infrastructure health.
Talk to a human.
For security questions, DPA requests, or vulnerability reports, write to security@co5.ai. For enterprise procurement, the founders are reachable directly.