Mycorr
Trust Center
Last reviewed 28 October 2026
You put your company's data into Mycorr, so you should know how we look after it.
This page sets out where your data lives, who can reach it, what we log and who we share it with. Everything here is true today.
- Hosted in
- European Union
- Encryption
- TLS and AES-256
- Model training
- We don't train on your data
- Permissions
- Down to each table
Standards
- ISO
ISO/IEC 27001
Held by Google Cloud, our host
Provider certified - SOC
SOC 2 Type II
Held by Google Cloud, our host
Provider certified - GDPR
UK and EU GDPR
Processor terms in our Privacy Policy
In our policy
Mycorr itself is not ISO 27001 or SOC 2 certified. The certifications above belong to our infrastructure provider.
Controls
Infrastructure
- Hosted on Google Cloud in the European Union
- Database reachable only over Google's private network
- Data centres covered by Google's ISO 27001 and SOC 2
Data protection
- Encrypted in transit with TLS
- Encrypted at rest with AES-256
- Saved credentials and AI keys encrypted a second time by Mycorr
Access control
- Permissions down to the single table
- Seeing a table and reading its values are separate permissions
- Admins can't read a space's content without a logged grant
- Access tokens can be revoked at any time
Audit and monitoring
- Audit log of organisation, member and billing actions, including any by Mycorr staff
- Every call an agent makes through MCP is recorded, without cell values or query text
- Infrastructure access logs kept for 400 days
- Rate limits on sign-in and our APIs
Secure development
- Every change is tested automatically before it ships
- Dependencies checked for updates every week
- Development and production kept separate
Privacy
- We act as a processor for the content you put in
- We never sell personal data
- We don't use your content to train machine learning models
- Processor terms in Section 13 of our Privacy Policy
Subprocessors
The companies that process data for us. We update this list before we add one.
Google Cloud
Hosting, storage, sign-in with Google
Postmark
Transactional email
Anthropic
AI features on Mycorr's own key, such as a personal account's trial
Serper
Web search for AI features
Discord
Support messages, system alerts
Google Analytics
This website only, with consent
If your organisation connects its own AI key (Anthropic, OpenAI or Google), that provider works under your own agreement with it and isn't our subprocessor. Payments are handled by Paddle, our merchant of record, under its own privacy notice.
Documents
Questions buyers ask
Is Mycorr ISO 27001 or SOC 2 certified?
No. Our infrastructure provider, Google Cloud, holds both, which covers the data centres, physical security and hardware. For everything above that, this page lists the controls we run.
Where is my data stored?
In the European Union, on Google Cloud. Some subprocessors, such as AI and web search providers, process data in the US when those features run. Those transfers are covered by the EU–US Data Privacy Framework or Standard Contractual Clauses (Privacy Policy, Section 7).
Do you train AI models on our data?
No. We don't use your content to train machine learning models. On Mycorr's own key, Anthropic may not train on it either. With your own key, your agreement with that provider applies.
Whose AI keys are used?
Your organisation's own. Owners and admins add a key for Anthropic, OpenAI or Google, and we store it encrypted. Personal accounts can try apps on Mycorr's own Anthropic key first.
Can AI agents read everything in our workspace?
No. An agent connected through MCP has only the permissions of the token it uses, and every call it makes is recorded.
Do you support SSO or multi-factor sign-in?
Not yet. You can sign in with Google, which applies your Google account's own 2-step verification, or with an email and password.
What happens when we delete our account or organisation?
You can delete either at any time, and cancel during a short grace period. After that, your tables, files, saved connections and access tokens are deleted.
Can we get a Data Processing Agreement?
Our processor terms are in Section 13 of the Privacy Policy and apply to every customer.
Report a vulnerability
Found a security issue? Email us the details and how to reproduce it. Please give us time to fix it before you share it. We reply within 1 working day.