Cortex

The Security Policy states that Cortex uses customer data 'only' to 'improve quality, reliability, and performance of the Cortex service' and explicitly prohibits selling or licensing data. However, the Privacy Policy uses vague 'service improvement' language without explicitly stating that user data is NOT used to train AI models. The absence of a clear, explicit statement that customer data is not used for AI model training creates moderate concern despite the acceptable use restrictions.

“[Security] 'The only acceptable use of processing customer data is to improve quality, reliability, and performance of the Cortex service. Cortex is not a data broker: Cortex may not sell or license customer data.'”

The ToS grants Cortex a broad license over user Feedback with language stating the company 'is not under any obligation of confidentiality' and can use feedback for any purpose including 'copy, modify, create derivative works, publish, distribute and commercialize.' However, this applies specifically to 'Feedback' (error reports, suggestions), not general customer data. The scope of the license to actual customer content/outputs is not explicitly addressed, creating moderate ambiguity.

“[ToS] 'Company is not under any obligation of confidentiality with respect to the Feedback...Company and its affiliates an exclusive, transferable, irrevocable, free-of-charge, sublicensable, unlimited and perpetual right to use including copy, modify, create derivative works, publish, distribute and commercialize) Feedback in any manner and for any purpose.'”

The Security Policy restricts sharing to 'only third parties required to provide Cortex services' (e.g., GCP), which is favorable. However, the Privacy Policy discloses sharing with 'subsidiaries and affiliates' and mentions use of multiple analytics providers (Google Analytics, Mixpanel, Segment.io) and data brokers (Vector.co). While these are disclosed, the Privacy Policy does not clearly distinguish between customer data and usage data sharing, and the affiliate/subsidiary language is broad without explicit DPA requirements listed.

“[Privacy] 'We may disclose your information also: to our subsidiaries and affiliates' and [Privacy] 'When you visit our website, Cortex works with https://www.vector.co, a data broker registered with the State of California, to obtain your email address.'”

The Privacy Policy states data is retained 'only for as long as is necessary for the purposes set out in this Privacy Policy' and mentions GDPR/CCPA deletion rights, but provides no specific retention periods (e.g., 30 days, 90 days). The policy notes 'Usage Data is generally retained for a shorter period' but does not specify duration. The vague 'as long as necessary' language without concrete timelines creates moderate concern about data exposure duration.

“[Privacy] 'We will retain your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy...Usage Data is generally retained for a shorter period, except when this data is used to strengthen the security or to improve the functionality of our Service.'”

The ToS explicitly states that 'Service and its original content (excluding Content provided by users), features and functionality are and will remain the exclusive property of Cortex Applications, Inc.' This language clearly excludes user-provided content from Cortex's ownership claims. The Feedback clause addresses only voluntary feedback submissions, not general service outputs. The company makes no claim to ownership of outputs generated by users.

“[ToS] 'Service and its original content (excluding Content provided by users), features and functionality are and will remain the exclusive property of Cortex Applications, Inc. and its licensors.'”

The Security Policy references 'generally accepted security best practices' and mentions implementation of 'new compliance measures and certifications' but does not list specific certifications achieved (SOC 2, ISO 27001, GDPR, HIPAA). The Privacy Policy mentions GDPR and CCPA compliance frameworks but provides no evidence of formal certifications or audit reports. A Trust Center is referenced but not provided in the documents.

“[Security] 'Cortex will follow generally accepted security best practices. Cortex will also implement new compliance measures and certifications.' and [Privacy] 'Visit the TrustCenter' (referenced but not provided)”