Curio · Security
Security at Curio
How Curio protects your studio and client information.
Encryption in transit
Curio is served over HTTPS. Data in transit between your browser and Curio is encrypted with TLS.
Per-project permissions
Access is scoped per project. A designer, client, or collaborator only sees the projects and records they are explicitly granted access to. One studio cannot see another studio’s data.
Private file storage
Uploaded plans, photos, and documents are stored privately. Access is through time-limited signed URLs, and public share links can be revoked or set to expire.
Secrets management
API keys and integration credentials are stored in secure secret storage and are never exposed to the browser or embedded in client code.
Payments
Payment card information is handled by Stripe, a PCI-compliant payment processor. Curio does not store full card numbers.
AI features
Some Curio features use third-party AI providers. Data handling is reviewed per provider, and Curio does not claim training practices it has not verified.
What Curio does not claim
Curio has not attained formal security certifications such as SOC 2 or ISO 27001. When those become available, they will be listed here. We do not represent security measures that have not been implemented.
Reporting a security issue
If you believe you have found a security vulnerability, please email hello@curiobyagr.com with details. We review every report. Please do not disclose potential vulnerabilities publicly before we have had a chance to respond.