Trust Center · Controls
What is enforced, and where
Curiosity is built to pass enterprise security review. Deployment, encryption, permissions and audit controls are documented below.
Your data · your environment
01 / 05
Hosting
6 controls
On premises hosting available
With an on premises deployment your data always stays in your environment. It can run fully air gapped.
Data centers with certified providers
Cloud deployments are hosted with providers that hold industry recognized certifications, such as ISO 27001 and SOC 2.
Data centers in Europe
Cloud deployments are hosted on Hetzner, a European provider with its infrastructure in Europe.
Isolated tenant environments
Customer data is separated into isolated tenants.
Secure infrastructure management
Deployment and secrets are managed through dedicated secure systems with restricted access.
Regular security patches
Hosting environments receive frequent operating system and dependency updates.
02 / 05
Encryption
4 controls
Data encrypted in transit
All communication uses TLS 1.2 or later.
Data encrypted at rest
All data stored in Curiosity is encrypted with AES-256.
Encrypted secret management
Tokens and credentials are stored encrypted, in secret management tools.
No model training on customer data
Customer data is never used to train shared or public AI models.
03 / 05
Users and access
5 controls
Single sign on (SSO)
Sign in through Google, Microsoft, Okta, Auth0 or any SAML2 provider.
Multi-factor authentication through your IdP
With single sign on, you enforce MFA in your own identity provider.
Least privilege and need to know access
Internal roles follow strict minimal access principles.
Access control for features
Restrict which users can reach which Studio features.
Strict internal access controls
Only authorized Curiosity personnel can access production systems, and only when required.
04 / 05
Permissions management
5 controls
Relationship based access control (ReBAC)
Manage permissions for teams, workspaces and user roles.
Permissions sync with data sources
Permissions are synced from the source systems, so nothing is duplicated and changes carry over.
Permissions apply across every feature
Permissions are enforced in the graph itself, so search, apps and AI all see the same access.
AI access restricted by permissions
AI features only use or produce content the user is authorized to see.
Configurable assistant behavior
Admins restrict the AI models, data sources and tools available per workspace.
05 / 05
Auditing
4 controls
Activity logging
User actions such as searches, file access, edits and settings changes can be logged.
Download and data access logs
Admins can monitor exports and file downloads.
AI action logging
Assistant queries, generated output and model interactions can be logged for compliance.
Security event monitoring
Relevant events can be monitored to detect anomalies or unauthorized access.
Your data. Your infrastructure.