Corent
Security and trust
Updated July 26, 2026
Corent routes AI media and text generation, which means customers trust us with prompts, conversations, outputs, and money. This page explains how that trust is protected, in plain language, and what we do and do not promise.
Architecture in one paragraph
Your request arrives over HTTPS, is screened by our content filter, routed to a model provider, and the output is copied into our own storage so you get a stable URL. We are a thin, stateless routing layer: no GPUs of our own, no card numbers on our servers, and every infrastructure layer is a managed platform with its own security team.
Practices
- All traffic is encrypted in transit (TLS); data is encrypted at rest by our storage providers.
- API keys are 256-bit random values, stored only as hashes, revocable instantly, and shown once.
- Every new API key starts with a $10/day spend cap; you control per-key rate and spend limits.
- Payment webhooks are signature-verified; billing is idempotent, so retries cannot double-charge.
- Failed generations are never billed, and every charge is auditable per request via receipts.
- Prompts are screened before reaching any provider; abuse is enforced across all endpoints.
- We do not use your prompts or outputs to train AI models.
What we inherit from our platforms
Our infrastructure runs on platforms that maintain their own audited certifications: Supabase (SOC 2 Type II), Fly.io (SOC 2 Type II), Vercel (SOC 2), and Stripe (PCI DSS Level 1). Corent itself is an early-stage company and does not yet hold its own SOC 2; we say so plainly rather than imply otherwise. If your procurement process needs specific documentation, email hello@corent.tech.
Subprocessors
Third parties that may process customer data, and why:
| Provider | Purpose | Location |
|---|---|---|
| fal | AI model inference gateway (image and video generation) | United States |
| Runware | AI model inference gateway (image and video generation) | United Kingdom |
| BytePlus (ByteDance) | AI model inference (Seedream and Seedance models) | Singapore |
| AI model inference (text, image, video, and speech generation) | United States | |
| OpenAI | AI model inference (image and text generation) | United States |
| Black Forest Labs | AI model inference (FLUX image models) | Germany |
| Ideogram | AI model inference (image generation) | Canada |
| Kling AI (Kuaishou) | AI model inference (video generation) | China |
| Runway | AI model inference (video generation) | United States |
| ElevenLabs | AI voice synthesis | United States |
| OpenRouter | LLM inference gateway (text generation) | United States |
| Anthropic | AI model inference (text generation) and natural-language request planning (/v1/intent) | United States |
| Supabase | Database, authentication, and media storage | United States |
| Fly.io | API hosting | United States |
| Vercel | Website and dashboard hosting | United States |
| Resend | Transactional email | United States |
| Stripe | Card payments | United States |
| NOWPayments | Cryptocurrency payments | European Union |
The model provider list will grow as we add routing sources; this page is the canonical list and is updated before new subprocessors handle customer data.
Honest limits
We publish live status and reliability data instead of an uptime SLA. Generated media URLs are served from our storage; treat them as public links and do not embed secrets in prompts. Data residency today is United States by default; if you have in-region requirements, talk to us before relying on the service for that use.
Reporting
Security issues: security@corent.tech. Abuse or illegal content: security@corent.tech. We respond to security reports within 48 hours.