Your guest data, handled with care.

All guest data is stored in Supabase Postgres, hosted on AWS infrastructure in the Sydney region (ap-southeast-2). The Sydney Postgres instance is the sole persistent (at-rest) data store; AI features process limited guest data externally as described below.

File attachments (guest photos, observation attachments) are stored in Supabase Storage, same region.

Application hosting is provided by Vercel, with edge delivery from the nearest CDN node.

Data is encrypted at rest using AES-256 on Supabase-managed infrastructure.

All traffic between client, server, and database is encrypted in transit over TLS 1.2 or higher. TLS 1.0 and 1.1 are refused, and no unencrypted connections are accepted.

Database credentials, API keys, and service tokens are stored exclusively as environment variables in Vercel, never committed to source control.

Every row in every table is protected by Row Level Security (RLS). A user can only read or write data belonging to the hotel they are assigned to. This is enforced at the database level, not the application layer.

Roles follow a strict hierarchy: platform admin → hotel admin → manager → staff. Sensitive sections (SPA preferences, confidential observations, dietary restrictions) are additionally filtered by department.

Two-factor authentication (TOTP) is built in, with step-up verification required on sensitive areas and mandatory enrollment for privileged roles. Administrators can securely reset a team member's MFA. Single Sign-On (SAML/OIDC) is on the roadmap for enterprise clients.

Abuse is throttled at three levels: a distributed rate limiter at the edge, per-user caps enforced in the database on data-subject-rights endpoints such as export and erasure, and per-IP throttling on authentication.

CORN acts as a data processor. You, the hotel, are the data controller for your guest records. We process guest data strictly on your instructions.

We support the full range of GDPR data subject rights:

• Right of access — export all data for a guest in JSON format
• Right of rectification — edit or correct guest records from the admin interface
• Right of erasure — anonymize or delete a guestand all associated records — anonymization is audited
• Right of restriction — flag a guest record as restricted to prevent further processing
• Data portability — export in a structured, machine-readable format

Requests are fulfilled within 30 days of a verified controller request.

A Data Processing Agreement (DPA) compliant with Article 28 GDPR is executed with every client before any guest data is loaded. The DPA covers scope of processing, security obligations, subprocessor disclosure, breach notification, and cross-border transfer safeguards (Standard Contractual Clauses where applicable).

Contact privacy@meetcorn.com to request a copy.

CORN relies on a minimal set of trusted subprocessors. The current list:

• Supabase Inc. — database, authentication, file storage (Sydney, AU)
• Vercel Inc. — application hosting, edge CDN (global)
• Resend / Supabase SMTP — transactional email delivery
• Anthropic PBC — classification of staff observations: it reads the free text a staff member has written and proposes a type, a category and a visibility level, which that staff member confirms or overrides before anything is stored. Also used for guest summaries and for brief & preparation generation. Processes guest names and observation text at generation time. United States. Transfer safeguarded by Standard Contractual Clauses.
• OpenAI, L.L.C. — voice transcription. Dictated audio is sent for transcription and returned as text; the audio itself is never stored by CORN, and only the text a staff member confirms is written to the database. United States. Processed under API terms that exclude training on submitted data. Transfer safeguarded by Standard Contractual Clauses.
• Upstash— rate limiting. Receives a key derived from the caller's IP address and a counter; no guest data and no account data. Hosting region not verified.
• Sentry— error monitoring. Receives error messages, stack traces, the URL where the error occurred, and related debugging breadcrumbs. Request bodies and cookies are stripped before transmission, and no session recording is captured. Guest records are not sent to Sentry. Hosted in Sentry's European region (Germany).

Any change to this list is communicated to controllers 30 days in advance, with a right to object.

In the event of a confirmed data breach affecting personal data, affected controllers are notified within 72 hours of our becoming aware of the breach, in line with Article 33 GDPR.

Notifications include the nature of the breach, categories and approximate numbers of records affected, likely consequences, and remediation steps taken.

Guest data is retained as long as the controller (the hotel) maintains an active CORN account. On account termination, data is returned in exported form and permanently deleted within 30 days unless legal retention requirements apply.

Retention is also enforced automatically: guests inactive beyond your configured retention window are flagged daily for review, and anonymization requires explicit manager approval — every action audited.

Internal audit logs (who accessed or modified what) are retained for 12 months.

Individual guest records can be deleted at any time by an authorized user.

Every create, update, and delete on sensitive tables (guests, pillars, observations, stays, profiles) is logged with the acting user, timestamp, old and new values. Audit records are hotel-scoped and available to hotel administrators.

Reads are recorded too, within a scope we state precisely rather than round up. When a staff member opens a guest profile through the application, the access is recorded with the staff member, the guest, the surface and the time. Entries are de-duplicated over a short window, so a record is an access session, not a click — returning to the same guest minutes later does not create a new one. Managers have a dedicated review screen for these records.

What this does not cover: a read performed outside the application with otherwise valid credentials does not appear in this journal. We would rather say where the boundary is than let the feature be read as a complete record of every read.

Vercel deployments are immutable and versioned; a rollback to any previous release is available in seconds.

In the unlikely event CORN ceases operations, we commit to providing a full data export and a 90-day wind-down window for controllers to migrate.

CORN is an early-stage product. We are not yet independently certified, and we will not claim otherwise. Our current posture:

• SOC 2 Type I — sequenced after an independent penetration test on our first pilot environment; target within 6–12 months of pilot start.
• ISO 27001 — parallel or alternative track to SOC 2, per client preference; target 2027.

Our infrastructure providers are certified, and that is a different claim from CORN being certified:

• Supabase (database, authentication, storage) — SOC 2 Type II and ISO 27001. Reports at supabase.com/security.
• Vercel (application hosting, edge CDN) — SOC 2 Type 2 attestation for Security, Confidentiality andAvailability, and ISO 27001 certified. Both available through their trust centre at security.vercel.com.

Our commitments for production incidents:

Incidents are logged, root-cause analysed, and a written post-mortem is shared with affected controllers within 5 business days of resolution.

We recognize that hotels deploying CORN for guest profiling may be required to conduct a Data Protection Impact Assessment (DPIA) under GDPR Article 35.

We provide the following to support your DPIA:

• A completed CORN Data Flow description covering categories of data processed, retention periods, and legal bases
• Our executed Data Processing Agreement (DPA, Article 28 compliant)
• Our current subprocessor list with transfer mechanisms (Standard Contractual Clauses where applicable)
• Technical and organisational measures (TOMs) documentation

Contact privacy@meetcorn.com with subject line DPIA support request. We respond within 3 business days.

How data moves through the CORN stack:

Guest data used for AI features (names and observation text) is sent to Anthropic PBC under Anthropic's Commercial Terms and Data Processing Addendum (GDPR Article 28, Standard Contractual Clauses). Anthropic does not train on this data. Inputs and outputs are deleted within 30 days. If Anthropic's automated safety systems flag a request, they may be retained for up to two years, and the associated safety score for up to seven. A zero-retention agreement would remove that tail; CORN does not have one today.

Voice dictation is the second, separate path: when a staff member dictates, the audio is sent to the OpenAI Whisper API and returned as text. The audio is never stored by CORN, and only the text the staff member confirms is written to the database. OpenAI does not train on data submitted through the API, and its published endpoint table lists no abuse-monitoring retention for the transcription and translation endpoints CORN uses. United States, Standard Contractual Clauses. Both AI paths are triggered by an explicit staff action — nothing reads guest data in the background.

All data at rest remains in the Supabase Postgres instance in Sydney (AWS ap-southeast-2). No data transits third-party analytics or CDN caches.