What this website collects, and what it doesn't.
This page covers coriqo.io, the marketing site you're reading. It does not describe how a deployed Coriqo instance handles a customer's data. That is set by the agreement with that customer and by where the instance runs, which is often inside their own infrastructure.
Last updated 13 August 2026
The website itself
Google Analytics runs on the home page only. It records the usual: which pages were viewed, an approximate location derived from your IP address, your browser, and the link that referred you. We read it to see which pages get used. No other page on this site loads an analytics script.
Some pages have a form (contact, the obligations gap analysis, Evidence Connect requests and the waitlist). If you submit one, we store what you typed (your email, and your name, organization, topic and message where the form asks) along with the page you submitted it from, and the website you arrived from and any campaign tags (utm_source, utm_medium, utm_campaign) on the link you clicked. That arrival information is kept in your browser tab for the length of your visit (it is not a cookie) and is not sent anywhere unless you submit a form. We email a copy to the Coriqo team so a person can reply. Other "get in touch" buttons open your own email client with a message addressed to us, and nothing is submitted to this website until you send it.
What loads from somewhere other than us
- Google Fonts serves the two typefaces this site uses, so Google receives a request from your browser on every page.
- Google Analytics loads on the home page, as described above.
- jsDelivr serves the Markdown renderer used to display blog posts, on blog post pages only.
Nothing else on this site is loaded from a third party. There are no advertising tags, no session recorders, and no social tracking pixels.
Email you send us
We keep it in our mailbox and use it to reply to you and to run the design partner conversation. We don't sell it, and we don't add you to a mailing list you didn't ask to be on.
A deployed Coriqo instance
Coriqo is built to run in your own cloud account or on-premise, including air-gapped, with no outbound network access. Where it runs that way, your model risk records never reach our infrastructure at all. Where we host it for you, the handling terms are in the customer agreement rather than on this page.
Coriqo's AI features are zero-retention: your data is not used to train models, and no AI output enters the tamper-evident record without a named person approving it.
How long we keep things, and how to ask
Analytics data expires on Google's default retention schedule. Email we keep for as long as the conversation is live and our own records require. To ask what we hold about you, or to have it deleted, write to abdul@coriqo.io and we'll answer.
Changes to this page
The date above is the date this page last changed. We don't yet publish an archive of earlier versions.