Corti’s AI models are trained using strictly controlled datasets that comply with the EU General Data Protection Regulation.
All training data:
Is either synthetic, anonymized, or pseudonymized before use.
Comes from a lawful basis under Article 6 GDPR, including performance of contract, legitimate interest, or explicit consent from customers.
Data Minimization and Purpose Limitation
Corti adheres to the principles of data minimization (Art. 5(1)(c)) and purpose limitation (Art. 5(1)(b)).
This ensures that:
Training datasets are carefully curated to remove identifiers and prevent overfitting to any personal information.
Corti processes only the data strictly necessary to deliver, maintain, and improve its products, both during training and everyday use, ensuring that all information is treated securely and proportionately.
Security and Access Controls
Training data and models are safeguarded with state-of-the-art encryption and access management.
Corti’s teams operate under:
Least privilege access to all datasets.
Continuous monitoring and auditing for security and privacy compliance.
Hosting within GDPR-compliant EU infrastructure, with sub-processors covered under the EU/UK/Swiss–US Data Privacy Framework.
Corti upholds a culture of accountability and continuous compliance through the ISAE 3000 Type 2 assurance, providing independent external verification of GDPR compliance.
Privacy by Design and by Default
Corti embeds privacy-by-design principles across every stage of the lifecycle:
Each model development stage, from data collection to deployment, are reviewed by DPIAs and risk evaluations.
Customers and partners receive clear, accessible explanations about how data may be used for improving AI performance.
Personal data protection measures are built in by default, not added later.
Teams implement data segregation and automatic redaction when handling conversational or health-related information.
Data Retention and Lifecycle Controls
Corti enforces strict data retention policies to ensure responsible data use:
Training or validation data is retained only for as long as necessary to achieve model improvement objectives.
Outdated or redundant data is securely deleted or anonymized.
Version-controlled models include audit trails that document data lineage and training datasets for traceability.