Trust Center · FAQ
Security questions, answered
Curiosity is built to pass enterprise security review. Deployment, encryption, permissions and audit controls are documented below.
Your data · your environment
Is our data secure with Curiosity?
In the cloud, traffic runs over TLS 1.2 or later and your data is encrypted at rest with AES-256. On premises you hold the encryption key and the certificate. Access follows the permissions of your source systems, down to the record, and activity can be logged. The controls page lists every control.
Does Curiosity store or retain customer data?
An on premises deployment stores your data in your environment, and Curiosity holds none of it. A cloud deployment stores it in an isolated tenant in European data centers.
Does Curiosity use customer data to train AI models?
No. Customer data is never used to train shared or public AI models.
Is customer data shared with third parties or AI providers?
On premises, your records go only where you send them, and with a local model no AI provider sees them. Product usage, with each user's name and email address, goes to Mixpanel, and error reports go to Curiosity's own server until you switch them off. In the cloud, a language model sees the chats and referenced content a user sends it, temporarily and private to that user. OpenAI is the optional default, and you can choose another model. The subprocessors page lists everyone else.
Where is customer data hosted and processed?
Where you deploy. On premises it stays in your environment, and with an offline license it can run air gapped. Cloud deployments run on Hetzner, in Europe.
How is data encrypted in transit and at rest?
Cloud deployments use TLS 1.2 or later, and the graph and your files are encrypted at rest with AES-256. On premises you supply the encryption key and the certificate. Tokens and credentials are kept encrypted in secret management tools.
How does Curiosity control and restrict internal access to customer data?
Only authorized Curiosity personnel can access production systems, and only when required. Internal roles follow least privilege and need to know.
How is customer data isolated between organizations?
Each customer’s data is kept in an isolated tenant. An on premises deployment is your own environment.
What security certifications and audits does Curiosity maintain (e.g., SOC 2, ISO 27001)?
Cloud deployments are hosted with providers certified to standards such as ISO 27001 and SOC 2. The Security and Compliance Overview sets out the full posture. Download it from the resources page.
Does Curiosity offer a Data Processing Addendum (DPA) and support GDPR compliance?
Yes. Curiosity is a German company and GDPR compliant, and a DPA is available. The Data Protection and Processor Policy is available on request.
What is Curiosity’s incident response and customer notification process?
It is set out in the Incident Response and Breach Policy. Request it from the resources page.
Does Curiosity support enterprise authentication (SSO, SAML, SCIM) and role based access control?
Single sign on works with Google, Microsoft, Okta, Auth0 and SAML2, with MFA enforced in your identity provider. Access is relationship based, for teams, workspaces and user roles, and synced from your source systems. Ask us about provisioning for your directory.
Are audit logs and administrative controls available for enterprise customers?
Yes. User actions, downloads, exports and AI interactions can be logged. Admins can restrict features per user, and models, data sources and tools per workspace.
Can Curiosity be deployed in a private cloud or on premises?
Yes. Studio runs as a container on your servers or in your private cloud, and on Windows. Your data stays in your environment, and with an offline license the deployment can run fully air gapped.
Does Curiosity use subprocessors, and where can we review the list?
On premises, one: Mixpanel, for product usage analytics. Cloud deployments use five. Both lists are on the subprocessors page. The authoritative register is a document, available on request.
Your data. Your infrastructure.