Where your data lives, who can see it, and what runs on it.

Application state (contracts, quotes, dashboards) sits in a Swiss-hosted Postgres (currently Neon) with per-tenant isolation. The schema is namespaced by org_id; no cross-tenant queries are possible.

Tokenized receivables live on Polygon mainnet (or Polygon Amoy for testnet) as CMTAT contracts. The on-chain record is public by definition; the off-chain metadata (extract, scoring, KYC) is private.

Documents uploaded for AI extraction are kept for the life of the contract, then migrated to a long-term cold store at settlement. We never keep them indefinitely.

We can see everything in your account — that's how the AI extraction works. We have RBAC, audit logging on every admin action, and separation between support staff (who can see anonymised support tickets only) and engineering (who can see the system but not your data without escalation).

CurioInvest's parent entity (Curio Capital AG) can see aggregated metrics — never your data — for compliance reporting.

We never share your data with third parties, except: (1) sub-processors we name in this page, (2) law enforcement if presented with a valid Swiss or EU court order. We'll contest any order that isn't narrowly scoped, and we'll notify you unless legally barred.

AI extraction runs in our containerised environment. We use Anthropic Claude for vision (PDFs) and a fine-tuned small model for structured extraction. Neither is trained on your data — that's the default and the contract.

The tokenization engine deploys CMTAT contracts via a 2-of-3 multisig. The signing key holders are named officers of CurioInvest; the multisig is published on-chain so you can audit every action.

The settlement oracle, when configured, calls a public bank-API endpoint. It is rate-limited and only acts on confirmations that have been cross-validated against the underlying payment reference.

nDSG Art. 19 gives us a 30-day breach notification deadline. We commit to notifying affected customers within 72 hours of confirmed incident, with full forensic detail.

Our incident response runbook is tested quarterly. Status page: status.curioinvest.com (in progress as of 25Q4).

Customer-side: every contract has a one-click export of the full transfer log + contract history. Take it with you. We never lock your data in.