Cortex is built on a simple rule: data entered into a workspace stays inside that workspace and is never used to train AI models. The rule is enforced in code with three layers, not just promised in policy.
Layer 1: provider (hard)
Cortex runs on Anthropic's Claude through Anthropic's commercial API, whose terms prohibit training on API inputs and outputs. Google Gemini is used for embeddings (knowledge search), some media generation and some lighter tasks. Neither provider may use your data to train its models. Anthropic keeps API inputs and outputs for up to 30 days for trust and safety review. Limnn does not have a zero-data-retention agreement with Anthropic.
A data-security guard fences off any weaker path. If Cortex is not configured to use Claude in production, workspace-data requests fail closed with an error instead of silently going out on a fallback provider.
Layer 2: isolation (hard)
- Every AI tool and query is scoped to a single workspaceId.
- assertWorkspaceScope refuses to run an AI action with a missing or blank scope, so a call can never fan out across workspaces.
- Agents only see the tools allowlisted in their playbook.
Layer 3: instruction (soft)
A data-containment clause is appended to every Cortex and authoring system prompt. It tells the model that workspace data only flows inward: it can use public knowledge to create or change things, but never reveals or transmits workspace data outward. This is defense in depth on top of the hard layers.
Action guardrails
- WRITE and RISK tool calls are staged for human approval unless autonomy is raised.
- Per-playbook spend caps and per-tool limits (for example refund caps) bound the impact of any run.
- Escalate rules and confidence-to-send thresholds route uncertain cases to a person.