The objection that kills most AI adoption at mid-market and up is security. "We cannot have an AI touching our financial or customer data." The objection is right to exist. Most AI tools were built fast, not securely.
CorpusIQ was built around three security controls: read-only source access, scoped data lifecycles, and revocation at the source. This post explains what each control does and, just as importantly, what it does not promise.
Primitive one: read-only external-source retrieval at the connector level
CorpusIQ read-only retrieval tools request source-specific retrieval scopes. The only tools that accept writes are CorpusIQ control-plane tools, which manage your own CorpusIQ configuration and never write to a connected system.
Provider scopes differ. Some providers expose narrow retrieval scopes; others group permissions under broader scopes. CorpusIQ documents the operations it exposes independently of the provider's scope labels.
This matters because AI makes mistakes. Retrieval operations and operations that accept writes must be separately named and annotated so clients can apply the right confirmation and policy controls.
Read-only retrieval is one layer of defense in depth. Tool routing and behavior-matched annotations remain necessary because provider scope models vary and CorpusIQ also has control-plane operations that write to your CorpusIQ configuration.
Connector tools are retrieval-only. Only CorpusIQ control-plane tools accept writes, and only to your CorpusIQ configuration.
Primitive two: scoped data handling by product path
The most common AI security mistake is caching. Tool A pulls data from QuickBooks, caches it for performance, then has to worry about the cache being breached or mishandled.
Direct MCP retrieves source data for the current request without retaining raw customer files or full connector response payloads. Operational logs and optional indexed search have separate lifecycles, and authorized source context passes to the selected AI client.
When Claude asks CorpusIQ for your cash position, the flow is:
- Claude sends a tool call to CorpusIQ's MCP server
- CorpusIQ authenticates the call, reads the OAuth token from Azure Key Vault
- CorpusIQ calls QuickBooks' API with the token
- QuickBooks returns the data to CorpusIQ
- CorpusIQ streams the data back to Claude
- CorpusIQ releases the response payload after the request; bounded operational metadata follows the published log-retention schedule
Local AUDIT logs contain raw query text and tool parameters plus bounded result summaries. The Azure Log Analytics workspace retains those logs for 30 days. Optional indexed search retains embeddings and minimal metadata until connector revocation or account deletion.
This architecture keeps the direct-retrieval footprint smaller than a raw-data warehouse while retaining the specific classes listed above. Security review should cover each class separately rather than relying on one blanket claim.
Primitive three: instant revocation
OAuth revocation is built into every connector. Users revoke CorpusIQ's access at any time from the source system:
- Google: myaccount.google.com/permissions
- Microsoft: account.microsoft.com/consent
- QuickBooks: My Apps in the Intuit account
- Shopify: Apps in the Shopify admin
- Slack: Connected apps in workspace settings
- Every other connector: standard OAuth revocation flow
Provider-side revocation follows the provider's lifecycle. CorpusIQ surfaces authorization failure when a subsequent call observes the revoked grant.
Disconnecting in CorpusIQ commits removal of its stored connection state and requires reauthorization before reuse. Provider authorization remains provider-governed and can be managed in the provider's controls.
The infrastructure layer
CorpusIQ runs on Azure Container Apps. Multi-source MCP servers are containerized, single-region (primary Azure region for deployment), 2 vCPU / 4 GiB per instance, autoscaling from 1-3 replicas based on request volume.
Key infrastructure choices:
Azure Key Vault for token storage. Managed identity authentication, no secrets in config files or environment variables.
Log Analytics for operational logging. 30-day queryable window, structured logs, every tool call emitting an audit event with user_id, tool_name, session_id, and request_id.
Bicep infrastructure-as-code with GitHub Actions deployment. All infrastructure changes are version-controlled and reviewed. CorpusIQ stores account state, subscription state, and encrypted OAuth tokens while an account is active. Direct MCP avoids a raw-file/full-payload warehouse; optional indexed search and retained operational/compliance records are governed separately.
The audit trail
Every tool call is logged. The log includes:
- User ID (CorpusIQ user identifier, not the user's email)
- Tool name (e.g.,
quickbooks_get_balance_sheet) - Session ID
- Timestamp
- Request ID
- Source application (Claude, ChatGPT, Perplexity)
What is not logged: raw customer files or full connector response payloads. The audit trail can include query text, tool-call metadata, and a bounded outcome summary.
For regulated industries, this log is exportable on request. It is enough to answer "who accessed customer data on date X" without exposing the data itself.
What CorpusIQ does not do
Three things worth naming plainly.
CorpusIQ does not use customer data to train models; conversation handling follows the AI-provider plan and settings you choose. CorpusIQ retention still follows the direct-MCP, operational-log, optional-index, and compliance-record lifecycles described above.
The data path includes the connected source, CorpusIQ, and the selected AI provider. Each source and provider has its own data policy.
CorpusIQ does not guarantee what the AI provider does with the data in transit. Anthropic has published its data retention policies for Claude. OpenAI has its own for ChatGPT. CorpusIQ operates within those. If a user is concerned about AI provider data handling, that concern is about the provider, not about CorpusIQ.
Why this matters for mid-market and enterprise
At the SMB level, security posture is often taken on faith. Nobody reads the SOC 2 report. Everyone just uses the tool.
At mid-market and enterprise, security reviews are real. A tool that connects to financial systems, CRM, and document storage has to answer: what scopes, what storage, what revocation, what audit. A tool that cannot answer those questions does not get approved.
CorpusIQ gives reviewers concrete controls to inspect: read-only scopes, documented retention classes, revocable tokens, audit trails, and managed infrastructure.
See also
FAQ
Is CorpusIQ SOC 2 aligned?
Yes. CorpusIQ maintains a SOC 2 aligned posture and runs on Azure infrastructure designed for audit expectations. The SOC 2 control set is followed in CorpusIQ's own operations. For current certification status, contact sales.
Where is data processed?
CorpusIQ runs on Azure Container Apps in a single region. No data crosses borders beyond what the source systems (Google, Microsoft, etc.) already do.
What happens to my tokens if I cancel?
All OAuth tokens are deleted on account cancellation. The tokens are also individually revocable through each vendor's admin console any time.
Can Anthropic or OpenAI see my data?
Data passes through the selected AI client to generate responses. Conversation retention and training follow the provider plan and settings you choose. CorpusIQ's separate direct-MCP, log, optional-index, and compliance-record lifecycles are described below.