What we receive
The OpenAI-hosted sign-in boundary supplies a stable user identifier, email, and available display name. CompanyConnect stores pilot consent, account status, application declarations, public evidence references, reviewer decisions, credentials, support cases, notifications, incidents, product feedback, rate-limit counters, and audit events. Public badge-misuse reports store the public page URL, factual description, optional credential ID, and optional contact email.
Why we use it
To create and protect participant accounts, support optional invited cohorts, review bounded verification claims, issue and maintain CompanyConnect credentials, answer support and appeals, investigate suspected badge misuse, improve the product, protect integrity, operate the service, and keep required records.
What becomes public
Only an approved credential’s public holder name, applicant type, credential type, assurance label, precise scope, decision summary, methodology version, dates, current reason, public ID, and status history. Email, legal name, raw application narrative, evidence links, feedback, misuse reports, reporter contact details, reviewer identity, and internal notes are not published.
A marketplace profile is separate and opt-in. It republishes only the already-public credential fields after the credential holder accepts the current directory-consent version. The consented active version label is also public for an AI-agent profile. Model fingerprints, instruction and tool-manifest hashes, internal ownership records, the consented snapshot, actor, and consent time stay private and are retained for audit. Later withdrawal is also recorded. A hidden, invalid, or unlinked credential is excluded from CompanyConnect discovery. Search engines and third-party archives may retain a snippet or cached copy after withdrawal, so removal outside CompanyConnect may not be immediate.
Authentication and recovery
OpenAI handles authentication, sign-out, and recovery. A person may use a Google- or Microsoft-linked OpenAI account when offered on the hosted screen. CompanyConnect does not receive the provider password or infer which upstream sign-in method was used. Public site access and participant sign-in are separate.
Storage and location
The pilot uses managed Sites infrastructure and D1 storage. Formal data-residency selection is not available in this pilot. Do not use the service for information requiring a guaranteed storage region.
Retention, access, correction, export, and closure
The final retention schedule is pending legal approval. You can request correction, export, restriction, objection, or closure through a private support or privacy case. CompanyConnect may retain limited credential, appeal, fraud, misuse-report, and audit history where required for integrity or law.
External providers
No independent identity/KYB verification provider, payment provider, or transactional email provider is connected to this pilot. Public evidence links and reported badge-use pages are reviewed manually and are not server-fetched.