The vault we can’t open.

Your key never leaves your device.

With end-to-end encryption enabled, your records are encrypted with a key only you hold. Corpus stores ciphertext — we cannot read, sell or leak what we cannot decrypt.

When analysis is needed, it runs where the plaintext already is: on your device, or in an isolated session that is destroyed afterwards. Your identity is never sent to a third-party model. (We’ll be explicit on this page about what runs on-device today versus what’s on the roadmap — no hand-waving.)

If something happens to you, the right person can still help.

You can grant a trusted physician or relative time-limited, read-only access that activates only if you don’t decline within a window you set — and every access is logged. You stay in control the whole time.

1. 1

   You nominate

   Pick a trusted physician or relative and set a wait window.

2. 2

   They request

   In an emergency they ask to unlock your record.

3. 3

   You can decline

   You’re notified and can block it anytime in the window.

4. 4

   Time-limited read

   If you don’t decline, they get read-only, audited access.

Trustworthy because it’s traceable.

A record is only useful to a clinician if they can trust where it came from. Corpus keeps provenance on everything and is explicit about what it is — and isn’t.

Aligned with you, by construction.