Security and compliance.
Corexi is fully hosted. It needs no installation, no firewall change and no inbound access to your infrastructure, and inside your product the run keeps to fixed limits.
- EU data processing
- GDPR compliant
- AES-256 at rest
- No inbound access
What a run may do, and what it never does.
Autopilot signs in and uses your product like a new user. It reads and it clicks; it does not change your data, your code or your settings.
- ✓open INV-0142 · read
- ⛔blocked · Send invoice · would submit a form
- ✓open Download PDF · preview
- ⛔blocked · Record payment · pays
- ⛔blocked · Delete · deletes
Nothing was saved, sent, paid or deleted. Blocked controls are listed in the run, so you can see what it chose not to press.
- Logins stay locked
Stored encrypted and used only to sign in. We recommend a test account per role.
- Some buttons it never presses
Save, pay, delete, invite, sign out, clock in and security settings, plus any words you add. Forms are opened and filled, never submitted.
- You can watch, and take over
Every step is live on screen. Take the browser over at any moment, or stop the run.
- It stops for a person
Where a login needs a person (an SMS code, a captcha), it stops and asks you. It never solves a captcha.
Architecture, data and compliance.
Cloud-native SaaS
- Fully hosted. No on-premise installation, no VPN, no agent on your servers.
- Your team uses Corexi in a standard web browser, over HTTPS.
- No software to install on your infrastructure.
Network and firewall
- All connections are outbound HTTPS (port 443). No inbound ports.
- No firewall changes, IP allow-listing or VPN tunnels.
- Autopilot reaches your product through a browser, as a signed-in user would.
- Analytics connect over outbound OAuth to the provider's API (GA4, Mixpanel and others).
- MCP calls go from the developer's IDE to Corexi's cloud API.
Data protection
- Data processed on EU infrastructure.
- GDPR compliant by design.
- Credentials encrypted at rest (AES-256-GCM).
- Read-only access to analytics. We never write to your data.
- No personal data collected from your end users.
- No script added to your product unless you add the optional snippet.
Compliance
- Audit log for all admin actions.
- Data retention configurable per workspace.
- Custom DPA on request.
- SOC 2 Type II and SSO / SAML (Enterprise) are on the roadmap; ask us for the current status.
Behavioural snippet (optional)
- Light JavaScript (under 5 KB gzipped), served from Corexi's CDN.
- Deployed the way Google Analytics, Hotjar or Clarity are.
- If your CSP restricts external scripts, allow pixel.corexi.ai.
- No cookies, no personal data, no session replay.
- Entirely optional. Corexi works without it.
Questions from your IT team?
We are happy to walk your security or IT team through the architecture on a call. Custom DPAs on request.