CorroborateMe privacy & data

Where a company customer uses our login-link or OIDC features for their end users, that company is typically the controller of end-user identity data for their app; we process it to provide the Service on their instructions.

Console accounts: email and authentication artifacts (session tokens, optional OAuth / passkey credentials).

Login-link end users: email, password hashes, OTPs (short-lived), passkeys, login session metadata, and delivery outcomes (redirect, webhook, etc.).

Technical: IP and request metadata needed for security, rate limiting, Turnstile bot checks, and operations.

Companies: company name/slug, memberships, plan and billing references, API key hashes (not raw keys after mint), integration secrets (encrypted at rest), webhook allowlists, and audit/usage records.

We use personal data to authenticate users, operate companies and APIs, meter usage, bill paid plans, prevent abuse, comply with law, and improve reliability.

We retain data while accounts and companies are active and as needed for security, billing, and legal obligations.

Archived audit batches may retain limited identifiers until object lifecycle expiry.

Processing may occur in the regions where Cloudflare and our processors operate. By using the Service you acknowledge that transfers may be necessary to provide it.

Infrastructure runs on Cloudflare (Workers, D1, KV, R2, Email Routing / sending as configured, Turnstile). Payments go through Stripe.

Contact support@corroborateme.com for access or deletion requests we cannot complete in-product.

Contact support@corroborateme.com for access or deletion requests we cannot complete in-product.

We do not sell personal data.