# What data leaves my environment when I use Cortex, and who can access it?

Company: Socra — Multiply Your Judgment
Canonical URL: https://support.socra.com/articles/art_01m14gt0czfnn9pgc5xbdtgyj9-company-data-and-proprietary-knowledge

Cortex is a Socra-hosted cloud service. Information leaves your environment when you or your agents create or update resources in Cortex.

## What Cortex receives

Cortex stores the resources submitted to it:

- Module content and version history
- Module dependencies
- Access-control grants
- Issues and comments
- Flash records, including the requested Module, included versions, caller, and usage metadata

Installing the Cortex CLI or connecting the Cortex MCP server does not cause Cortex to scan or upload your repository. Cortex receives only resources that you or your agents submit.

An agent may inspect source code as part of its own task. That activity happens at the agent boundary, outside the Cortex service. Any information the agent sends to its model provider is governed by the agent's configuration and your agreement with that provider.

## How Cortex isolates customer knowledge

Your Socra Account is the tenant boundary. Cortex derives the Account from the authenticated credential. A client cannot supply a different Account ID to reach another tenant.

Every Cortex resource is scoped to that Account. We enforce the Account boundary on reads, writes, searches, and dependency traversal. Cross-account resources are returned as not found.

This is logical tenant isolation enforced by our authorization and data-access layers. It is not a dedicated customer database or private deployment.

## How you control access

Each Module is its own authorization boundary. You can grant access to individual people, application identities, or groups.

- **Viewer:** Can read and Flash the Module
- **Commenter:** Has viewer access and can comment
- **Editor:** Can change Module content and dependencies
- **Admin:** Can manage the Module's access policy
- **Module owner:** Has full control

A child Module can inherit its parent's access policy or use an independent policy. Assigning someone an Issue gives them access to that Issue, not to the owning Module.

Account ownership does not provide routine access to every Module. The Account owner has break-glass authority to repair an invalid access policy.

Within Socra, customer content is available only to personnel who need it for support, service reliability, safety, or legal obligations.

## What a Flash can disclose

When someone is authorized to Flash a Module, Cortex returns that Module and its complete dependency closure. Cortex authorizes the requested root Module once. It does not run another access check for every dependency in that Flash.

Adding a dependency is therefore a disclosure decision. Anyone who can Flash the parent can receive the dependent Module's content as part of the assembled context.

Creating the dependency requires access to both Modules. Receiving a Module through a parent's Flash does not grant direct access to that dependency.

## Storage and model processing

We store and process Cortex data on cloud infrastructure in the United States.

Cortex does not call a model API when it stores, searches, versions, or flashes Modules. If an authorized agent retrieves Cortex knowledge, that content enters the agent's session and may be processed by the model provider configured for that agent.

We do not sell customer data or use customer content to train models.

Module knowledge is versioned. Archiving a Module removes it from active use but is not an erasure mechanism. Credentials, private keys, and review secrets should never be stored in Modules or Issues.

We do not currently offer customer-managed encryption keys, regional data residency, or a private or self-hosted Cortex deployment.

## Article details

- Collection: [Cortex](https://support.socra.com/collections/col_01kzpmz5q2hz8avw3tys0tnx4f-cortex)
- Published: 2026-08-28
- Updated: 2026-08-28
- Canonical: https://support.socra.com/articles/art_01m14gt0czfnn9pgc5xbdtgyj9-company-data-and-proprietary-knowledge