Security
Security and data, stated plainly.
What we do today, who processes your data and where, and what we are still working toward. We are not certified yet, and we say so until we are.
What we do today
You control the data
Your company owns respondent data and sets consent wording and retention. We process it on your behalf. Respondents see your company named as the controller.
Stored in Korea
Service data and files are stored on Microsoft Azure in the Korea Central region.
AI processing
Answer analysis, transcription and interview questions run on Azure OpenAI Service, in the US (East US 2) and, for Voice, Sweden (Sweden Central).
Not used for training
We don’t use your data to train models, and Microsoft does not use Azure OpenAI inputs or outputs to train models.
Masking before AI
Signal masks email addresses, phone numbers and similar details in answers before sending them to the AI model.
Guarded exports
Exports that include personal data are limited to owners and privacy managers, need a fresh sign-in check, and download once with a password.
Sign-in and roles
Passkeys, Google or email codes. Sessions are server-side and can be ended. Each teammate sees only what their role allows.
Who processes data
| Processor | What for | Where |
|---|---|---|
| Microsoft Corporation (Azure) | Hosting, storage and email | Korea Central |
| Microsoft Corporation (Azure OpenAI Service) | Analysis, summaries, translation, transcription, interview questions | United States; Sweden for Voice |
| Toss Payments Co., Ltd. | Card payments and recurring billing | Korea |
The privacy policy is the full and binding list. Read the privacy policy
What we are working toward
We are building these controls in from the start. None of them is a certification claim.
ISO/IEC 27001, 27701 and ISMS-P
Our security program is built toward these standards. We are not certified yet.
Field-level encryption
Encrypt personal-data fields with keys held in Azure Key Vault.
Append-only audit log
One audit trail for staff access and sensitive actions.
Retention and deletion
Automatic deletion when retention ends, including backups.
Data subject requests
Handle access and deletion requests through an API.
Incident response
Notify affected customers within 72 hours of a confirmed incident.
Report a security issue
Found a vulnerability or have a security question for a vendor review? Email us. peter@askcuri.com