Privacy & Data Protection

Your Knowledge.
Your Organization's Asset.
Your Questions Answered.

Honest answers to every question you should ask before trusting us with your organization's institutional memory.

v2026-08-08  ·  EverCortex

We wrote this because you deserve to know exactly what happens to your knowledge. EverCortex asks executives, subject-matter experts, and leaders to share decades of hard-won judgment. That is a significant act of trust. We will not answer it with vague reassurances or a policy document written to limit liability — we will tell you precisely how your knowledge moves, where it lives, and who can see it.

If you have a question not answered here, contact us at frank@evercortex.ai. We will respond personally.

Ownership & Control

The knowledge you share always originates with you. The legal question — who owns the captured record of it — depends on the relationship under which EverCortex is deployed:

·
Enterprise deployments (the most common case): When your organization subscribes to EverCortex to capture your expertise, the resulting Expertise-Arc is owned by your organization. The capture is conducted under the terms of your employment and any knowledge-capture agreement your organization has in place. Think of it the same way as internal documentation you might write: you authored it, but it is a company record.
·
Individual subscriptions: If you subscribe to EverCortex directly — to capture your own professional legacy, consulting methodology, or domain knowledge — you own the resulting Expertise-Arc completely.
What Cornerstone Technologies owns: nothing about your knowledge. Cornerstone is the technology provider and a custodian of the data. We hold it on your organization's behalf. We do not claim, sell, license, or otherwise commercialize your knowledge or the Expertise-Arc built from it.

This is the most sensitive question in any enterprise knowledge-capture program, and we want to answer it precisely.

What the Expertise-Arc contains: EverCortex transforms your interview responses into a structured knowledge graph — frameworks, decision models, domain expertise, judgment patterns. It is not a verbatim transcript database. The raw audio and text of your capture sessions are used to build the arc and are not the primary artifact surfaced to your organization.

What your organization's administrators can access: the Expertise-Arc as a whole — the distilled, structured knowledge — as that is the product they subscribed for. Session transcripts may be accessible to administrators depending on the deployment configuration your organization selected.

Recommended practice: before your capture sessions, ask your organization's EverCortex administrator what transcript access is enabled for your deployment. If you want certain topics to stay off the record, say so explicitly at the start of that portion of the session — our capture process respects and records off-the-record markers.

What this means in practice: treat an EverCortex capture session the same way you would treat a recorded interview with your organization's knowledge management team. It is a professional exchange, not a private conversation.

In enterprise deployments, the right to delete content from the Expertise-Arc belongs to the organization, not the individual contributor — since the organization owns the record. If you leave a company and want your knowledge removed from their EverCortex deployment, that is a request your organization's administrator must make, not one you can make unilaterally.

For individual subscriptions, you retain full delete rights. You can request deletion of your entire Expertise-Arc at any time and we will comply within 30 days, typically much sooner.

If you are negotiating your departure from an organization, we recommend addressing EverCortex content alongside any other IP or document-retention discussions. We will honor whatever your organization directs us to do with your content.
How Knowledge Is Captured & Stored

A capture session is a structured conversation — guided by EverCortex's AI interviewer — in which you articulate your frameworks, decisions, domain expertise, and the judgment that comes from experience. Here is the data lifecycle for a typical session:

1
You speak or type your responses. If voice, your audio is transcribed in real time using an on-premise speech-to-text service running on Cornerstone infrastructure — your audio does not leave our systems for transcription.
2
The transcript is analyzed by an AI language model (see the AI providers section below) to extract structured knowledge: frameworks, decision rules, domain terms, key relationships, and relevant precedents. This extraction is the core of what builds your Expertise-Arc.
3
The extracted knowledge is stored in your organization's Expertise-Arc — an isolated, encrypted knowledge graph specific to your organization's EverCortex deployment.
4
The session transcript is retained as a source record, encrypted at rest. Its accessibility is controlled by your organization's administrator configuration.

Yes — completely and by design. Every EverCortex organization has its own dedicated Expertise-Arc, isolated at the data layer. This is not access-control on a shared database; it is a fundamental architectural choice.

What isolation means in practice:

·
Your Expertise-Arc is scoped exclusively to your organization's tenant. Every database query is filtered by organization ID at the application layer and enforced at the database layer. There is no code path that can return your organization's knowledge in response to another organization's query.
·
The Recall and Mentor systems — the interfaces that deploy your captured knowledge across operations — only draw from your organization's arc. They have no access to any other organization's content.
·
No knowledge aggregation across organizations. We do not build a cross-client knowledge base, train a shared model on your content, or otherwise use one organization's arc to benefit another.
Your competitive intelligence, client relationships, and proprietary frameworks stay yours. An EverCortex deployment at a competitor cannot access or benefit from your organization's arc — architecturally or contractually.

A small, audited team of Cornerstone engineers and operators with production credentials can access the data in the course of operating and supporting the platform. This team is kept to the minimum necessary to run the service.

We use that access only for purposes you would expect:

·
Diagnosing a technical issue your organization reported, when the issue cannot be reproduced without examining your deployment's state
·
Restoring data from a backup at your organization's request
·
Performing routine operations: backup, database maintenance, security patching
·
Complying with a valid legal process, in which case we will notify you if legally permitted to do so

Every administrative action is logged with the time, source, and scope. We do not browse customer content for product research, competitive analysis, or any purpose not directly tied to operating your deployment.

Why we are telling you this directly: administrative access exists during normal operations and we prefer you know that clearly rather than discover it later. We are working to narrow this surface over time and will notify customers when stronger isolation is in place.

EverCortex runs on AWS infrastructure in us-west-2. The security posture:

1
Encryption in transit. All communication between your users and EverCortex is TLS 1.2 or higher. We do not accept unencrypted connections.
2
Encryption at rest. EBS volumes holding the Expertise-Arc database are encrypted using AWS KMS-managed keys. AWS-managed disk encryption protects against physical storage compromise.
3
Per-organization query isolation. Every database query the application issues is scoped to the authenticated organization's tenant ID, enforced at the database layer. There is no query path that can return one organization's arc in response to another's request.
4
Private network deployment. The EverCortex backend is not directly accessible from the public internet. Access is through Cloudflare's network with TLS termination, with the backend reachable only through authenticated, access-controlled tunnels.
5
IAM and least-privilege access. AWS IAM roles follow least-privilege principles. No service has broader AWS permissions than it needs to operate its specific function.
AI Providers — Which Ones, When, What They See

EverCortex routes different tasks to different AI services, each chosen for its strength at that function:

1
Anthropic (Claude models) — Used for the capture interview: forming the questions the EverCortex interviewer asks, extracting structured knowledge from your responses, and synthesizing the Expertise-Arc. Claude is the primary language intelligence in the product.
2
On-premise speech-to-text (Whisper) — Session voice recordings are transcribed on Cornerstone's own infrastructure using an open-source Whisper model. Your audio does not leave our systems for transcription — unlike many voice products, this step stays entirely on our servers.
3
On-premise embedding models — The semantic search that powers Recall (retrieving the right knowledge at the right moment) runs on embedding models deployed on our own GPU infrastructure. Your knowledge is not sent to a third-party embedding API.
We may add or change AI providers as the product evolves. We will update this document and notify customers before any material change to which providers process your knowledge.

No — and we are specific about why.

·
Anthropic API: Data submitted through the Anthropic API by developers is not used to train Anthropic's models without explicit customer agreement, per their current API data policy. We have not provided that agreement and will not.
·
On-premise services (Whisper, embeddings): These run on our own infrastructure. There is no upstream provider receiving your data, and we do not use your content to retrain or fine-tune these models.
·
Cornerstone models: We do not train any internal model on your organization's Expertise-Arc to benefit other customers. Your captured knowledge improves your deployment only.
Honest caveat: provider policies are set by those companies and can change. We monitor them and will notify customers of any material change before it could affect their data. We recommend reviewing Anthropic's current policy directly at anthropic.com/privacy.
Risk Assessment

Honest assessment, not a reassurance campaign:

RiskLikelihoodImpactOur mitigations
Anthropic API data breach
Knowledge sent to Claude API is exposed		 LOW HIGH if it occurred We send only what is necessary per call. Anthropic is a well-resourced provider with a strong security program. We cannot control third-party security.
Cornerstone infrastructure breach
Our AWS environment is accessed without authorization		 LOW MEDIUM-HIGH AWS KMS disk encryption, per-organization query isolation, private network topology, IAM least-privilege, audit logging. An attacker reaching running database services could, in principle, read arc content — we mitigate but cannot guarantee zero residual risk at this tier.
Cornerstone administrative misuse
An employee accesses content inappropriately		 LOW MEDIUM Minimal admin team, rotated credentials, full audit logging on every administrative action, written use policies. Every access is logged with time, source, and scope.
AI provider policy change
Anthropic changes API data policy to allow training		 MEDIUM MEDIUM We monitor provider policies and will notify customers before any material change takes effect for their data.
Government or legal demand
A court order requires us to produce your knowledge		 LOW MEDIUM We challenge improper demands, produce only the narrowest responsive content, and notify you when legally permitted. We will include such demands in an annual transparency report.
Your Rights & Our Commitments

Your organization can request a full export of your EverCortex deployment at any time. The export includes:

·
The Expertise-Arc as structured JSON — all knowledge nodes, relationships, frameworks, and domain terms.
·
Session transcripts as plain text, timestamped by session.
·
Recall usage logs — what was queried, when, and by whom (for audit purposes).

Exports are delivered within 30 days of request, typically much sooner. Contact frank@evercortex.ai to initiate.

When a subscription ends, your organization has a 90-day window to export your Expertise-Arc and all session data in standard formats. After that window, all data is permanently deleted from our systems under documented deletion procedures, and we will provide a deletion certificate on request.

We do not retain your knowledge for our own use after contract termination. Your arc is not repurposed, anonymized for training, or transferred to another customer.

If Cornerstone shuts down: we commit to at least 90 days' notice and a complete export of your organization's data before systems are decommissioned. After decommissioning, all customer data is permanently deleted under a documented procedure.

If Cornerstone is acquired: your data does not transfer to an acquirer without your organization's explicit consent. Any acquisition agreement requires the acquirer to honor this commitment or return your data. We treat your Expertise-Arc as something held in trust — not as a commercial asset included in a sale.

Reach out directly — we answer personally.

Email: frank@evercortex.ai
General inquiries: Cornerstone Technologies, Inc. · 2059 Camden Ave #298, San Jose, CA 95124

If you have a question not answered here, tell us — we will add it to this document.