Question 1

Where does Corti store patient data?

Accepted Answer

EU or US hosting options, stated with no cross-border transfer Published statement: "Data hosting options in the EU or US with no cross-border transfer" (source: https://corti.ai/safety, checked 2026-09-25). Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

Question 2

Where does Corti process data?

Accepted Answer

EU subprocessor list (last updated 7 August 2026) says Scaleway (France, the Netherlands, Germany and Sweden) is used for AI processing within the EU only and will not be used for hosting or storing customer data; DCAI (Denmark) provides inference, training, AI processing and GPU capacity; Microsoft Azure provides cloud hosting in the Netherlands, Ireland and Sweden (EU instance). Published statement: "Cloud infrastructure provider used for AI processing activities within the EU only and it will not be used for hosting or storing customer data." (source: https://www.corti.ai/legal/subprocessors/eu, checked 2026-09-25). Privacy policy states data may be transferred to and processed in Denmark; Corti Inc./Corti America Inc. certified under EU-U.S. Data Privacy Framework for US transfers Published statement: "we may transfer the data, including Personal Data, to Denmark and process it there" (source: https://corti.ai/legal/privacy-policy, checked 2026-09-25). Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

Question 3

Which AI models does Corti use?

Accepted Answer

Own healthcare model family 'Symphony' offered via API Published statement: "Symphony powers speech, documentation, coding, and reasoning through one API" (source: https://corti.ai/, checked 2026-09-25). Corti states its models are trained only on healthcare data Published statement: "Trained only on healthcare data - no internet noise" (source: https://corti.ai/safety, checked 2026-09-25). Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

Question 4

What certifications does Corti publish?

Accepted Answer

Safety page states Corti's security meets or exceeds market and regulatory requirements, including compliance with several strict frameworks, and displays framework logos (images without text labels) for ISO 27001, ISO 27017, ISO 27018, ISO 42001, ISO 13485, ISO 14971, ISO 62366, SOC 2, HIPAA, GDPR, CE, NHS DSPT, NHS DTAC, NHS DCB0129, Cyber Essentials Plus, EU AI Act, NIS2, DORA, ISAE 3000, BSI C5, US FedRAMP and EU-U.S. Privacy Shield. Published statement: "Corti ensures that its security meets or exceeds market and regulatory requirements, including compliance with several strict frameworks." (source: https://corti.ai/safety, checked 2026-09-25). Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

Question 5

Which subprocessors does Corti name?

Accepted Answer

EU subprocessor list (last updated 7 August 2026). Corti API: Scaleway (France, the Netherlands, Germany and Sweden; AI processing within the EU only), Microsoft Azure (Netherlands, Ireland, Sweden; EU instance; cloud hosting), Speechmatics (Ireland; supplementary speech recognition), Datadog (Germany; usage telemetry) and DCAI (Denmark; inference, training, AI processing, GPU capacity). Corti Embedded Assistant adds PostHog (Germany), Mixpanel (Netherlands) and Intercom (Ireland). A separate US list and an FR list are published; an EU Sovereign list is marked coming soon. Published statement: "Scaleway | France, The Netherlands, Germany and Sweden | Cloud infrastructure provider used for AI processing activities within the EU only … DCAI | Denmark | Inference, Training, AI processing, GPU capacity" (source: https://www.corti.ai/legal/subprocessors/eu, checked 2026-09-25). US subprocessor list (last updated 7 August 2026). Corti API: Microsoft Azure (United States; US instance; cloud hosting), Speechmatics (Ireland), Datadog (Germany), Corti America (United States) and Corti AI UK (United Kingdom), the last two for customer success and technical support. Corti Embedded Assistant adds PostHog (Germany), Mixpanel (Netherlands) and Intercom (Ireland). Published statement: "Corti America | United States | Customer success and technical support; U.S.-based staff may access non-sensitive personal data for troubleshooting, incident resolution, and quality assurance." (source: https://www.corti.ai/legal/subprocessors/us, checked 2026-09-25). Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

Question 6

What does Corti publish about TGA status?

Accepted Answer

Not found on public pages. We could not find this on the vendor's public pages as at the check date. This is not a statement that the vendor lacks the capability or has not disclosed it elsewhere. Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

Question 7

Which practice management systems does Corti list as integrations?

Accepted Answer

Not found on public pages. We could not find this on the vendor's public pages as at the check date. This is not a statement that the vendor lacks the capability or has not disclosed it elsewhere. Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

Question 8

Which Australian or New Zealand entity does Corti contract through?

Accepted Answer

Not found on public pages. We could not find this on the vendor's public pages as at the check date. This is not a statement that the vendor lacks the capability or has not disclosed it elsewhere. Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

Question 9

What support hours does Corti publish?

Accepted Answer

Not found on public pages. We could not find this on the vendor's public pages as at the check date. This is not a statement that the vendor lacks the capability or has not disclosed it elsewhere. Answered from what the vendor publishes on its own public pages, or from an official register where noted, as at the check date shown. Not an assessment, audit, certification or endorsement.

Corti

Data storage region

Data processing region

Model provenance

Subprocessors

Certifications

TGA status

PMS integrations

ANZ entity

Support hours

What Corti publishes — answered from the record

Something wrong or out of date?