Loading…
Loading...
Security and privacy
CurioPilot is used by children, so we treat their data with care: stored in the UAE, encrypted, kept separate for each school, and never sold or used to train AI.
Where your data lives
Microsoft Azure, UAE North
Database, files, backups and email
Encrypted, one school per space
One school can never see another’s data
Names hidden from the AI
“Student A” goes in; the real name comes back only on your screen
How we protect data
Student data, files and backups are kept in Microsoft Azure’s UAE North region.
Data is encrypted when it travels and when it is stored, including backups.
One school can never see another school’s data. We test this on every release.
Names become placeholders like “Student A” and contact details are removed before anything reaches the AI. AI requests may be processed in another Azure region; the AI doesn’t learn from them.
Passwords with lockout, two-step sign-in for staff, and single sign-on for schools.
Teachers see their own classes; parents see their own children. Access is closed unless granted.
Privacy law
Built to the principles of the UAE Personal Data Protection Law, with data stored in the UAE.
We act on the school’s instructions under a data processing agreement. Families can download or delete their data.
AI features stay off until a parent gives consent, in line with COPPA.
For US schools, we work as a school official under FERPA, under the school’s direction.
Who handles data
We tell schools 30 days before adding a new service that handles their data. Last updated 2026-10-14.
Microsoft Azure
Main infrastructure: database, file storage (kept separate per school), background jobs, email, logs and monitoring
Azure OpenAI (Microsoft)
AI: question generation, grading and feedback, recommendations and the assistants
Prompts and answers are not used to train models.
Twilio
SMS to parents — off by default, switched on per school
Stripe
Family subscription billing (schools are invoiced directly)
Browser push services
Delivering notifications a person turned on in their browser
Microsoft Azure
Hosting this website, counting page views without cookies, and sending the messages you write in our contact form to our team
Found a problem?
If you think you have found a security problem, please tell us through the contact page and choose “Security”. Please only test with your own account, and give us reasonable time to fix it before sharing details.
FAQ
Yes, with every school, before any student data is added. You can read our standard agreement on the DPA page.
Not yet. CurioPilot runs on Microsoft Azure, which holds SOC 2 and ISO 27001 certifications. An independent security test of CurioPilot itself is planned before general availability.
We have a written plan for security incidents. Affected schools are told within 24 hours of us confirming an incident, and regulators within the time the law requires.
Only as long as the school or family needs it. When an account closes, there is a 30-day window to change your mind, then the data is deleted; backups are cleared within 90 days.
Yes. We share our security questionnaire answers and design notes with schools during evaluation. Ask us through the contact page.
A printable summary of hosting, protection, AI safeguards, privacy law and the services we use. For the data agreement or your questionnaire, ask us.