changes to the model + cors confidentiality instance