Trust Center · Overview
Security first. Always.
Curiosity is built to pass enterprise security review. Deployment, encryption, permissions and audit controls are documented below.
Your data · your environment
Controls
What is enforced, group by group
Five groups of controls, from where your data is hosted to what is logged about it.
Hosting
6 controls
- On premises hosting available
- Data centers with certified providers
- Data centers in Europe
Encryption
4 controls
- Data encrypted in transit
- Data encrypted at rest
- Encrypted secret management
Users and access
5 controls
- Single sign on (SSO)
- Multi-factor authentication through your IdP
- Least privilege and need to know access
Permissions management
5 controls
- Relationship based access control (ReBAC)
- Permissions sync with data sources
- Permissions apply across every feature
Auditing
4 controls
- Activity logging
- Download and data access logs
- AI action logging
Resources
Documents for your security review
The overview is a download. The policies are sent on request.
Information Security and Governance Policy
How security is owned, organized and reviewed.
Security Controls Standard
The controls on this site, at the level a reviewer needs.
Incident Response and Breach Policy
How incidents are handled and customers are notified.
Business Continuity and Disaster Recovery Policy
How the service keeps running and comes back.
Data Protection and Processor Policy
How personal data is processed, for your GDPR paperwork.
Data processed
What each deployment processes
Studio, hosted
Curiosity runs it, in European data centers.
- Professional email address and username
- Chat messages sent by users
- Documents uploaded by users
Studio, on premises
You run it, in your own environment.
- Professional email address and username
- Chat messages sent by users
- Documents uploaded by users
Chats and the file content they reference go to the language model you choose, temporarily and private to the user.
Subprocessors
Who else processes data, and when
It depends on where you deploy. On premises, nobody does.
- 1 provider
On premises deployments
Mixpanel
- 5 providers
Cloud deployments
Hetzner, Cloudflare, Stripe, OpenAI, Mixpanel
- 5 providers
Website only
Cloudflare, Google Analytics, Mailersend, Mailerlite, HubSpot
FAQ
The questions every review asks
Is our data secure with Curiosity?
In the cloud, traffic runs over TLS 1.2 or later and your data is encrypted at rest with AES-256. On premises you hold the encryption key and the certificate. Access follows the permissions of your source systems, down to the record, and activity can be logged. The controls page lists every control.
Does Curiosity store or retain customer data?
An on premises deployment stores your data in your environment, and Curiosity holds none of it. A cloud deployment stores it in an isolated tenant in European data centers.
Does Curiosity use customer data to train AI models?
No. Customer data is never used to train shared or public AI models.
Is customer data shared with third parties or AI providers?
On premises, your records go only where you send them, and with a local model no AI provider sees them. Product usage, with each user's name and email address, goes to Mixpanel, and error reports go to Curiosity's own server until you switch them off. In the cloud, a language model sees the chats and referenced content a user sends it, temporarily and private to that user. OpenAI is the optional default, and you can choose another model. The subprocessors page lists everyone else.
Your data. Your infrastructure.