Security
Built to survive a security review, not to talk its way around one.
Curated sits next to the data your organization cares most about. That earns you the right to hard questions, and it obliges us to answer them plainly.
- Your infrastructure, or ours
- Isolated per organization
- Never used to train a model
01 / Where it runs
Some data does not leave the building. That is fine.
Where Curated runs is a deployment decision. It is not a different product, and the one that runs on your own hardware is not the cut-down one.
On your own infrastructure
When the data cannot leave your perimeter, Curated runs inside it. Same product, same features. Where it runs is a deployment decision, not a lesser tier of the software.
On ours
The managed service, with your organization separated from every other one. Most teams start here and some stay here.
02 / The controls
Six things your security team will want to hear.
Isolated per organization
Your organization is separated at the database schema, not by a filter in a query that somebody could forget to write.
Never used to train a model
Your data is not training data. Not now, and not on a future roadmap. There is no version of this where that changes.
Your identity, your permissions
Sign in with your own ArcGIS account. Curated reads what you are already allowed to read and nothing you are not. It does not get a service account on your portal.
Entitlements you control
Which data sources an organization can reach is set per organization. A source your team is not licensed for is not there to be reached.
Bring your own model keys
If your organization has already decided which model it trusts, that decision stands, and the usage and the spend stay under your governance.
Nothing written back without you
Curated writes to your layers as you, under your own ArcGIS permissions, and waits for approval by default. Layers Curated creates keep a change history, and an owner can turn it on for any other, so edits there can be restored.
03 / Compliance
Built and operated under SOC 2 audited controls.
The controls cover access management, change control, monitoring and incident response.
In your security review
We take your security team through the control environment and the documentation your process requires.
Bring them in at the first meeting. Scoping the review early keeps it off the critical path of your rollout.
04 / The questions we get
-
What is your SOC 2 posture?
Curated is built and operated under SOC 2 audited controls, covering access management, change control, monitoring and incident response. Bring your security team in early and we will take them through the control environment and the documentation your process requires.
-
Do you train models on our data?
Never. Not to improve the product, not to improve a model, not for anyone else's benefit. Your data answers your questions and does nothing else.
-
Can we run Curated inside our own environment?
Yes. When the data cannot leave your perimeter, Curated deploys inside it. Raise it early, because it changes how a rollout is scoped.
-
What can Curated reach in our ArcGIS portal?
Exactly what the person using it can already reach. You connect your own ArcGIS account, Online or Enterprise, and Curated operates as that user. Your groups and your item permissions apply, unchanged.
-
Which model does it use, and where does our data go?
Curated is model-agnostic. Bring your own keys and the provider relationship is yours, with the spend visible to you. If you have standardized on a particular model or a private deployment, we work with that.
-
Can our security team run their own review?
Yes, and we would rather they did. Bring them into the conversation early and we will answer their questions directly.
Bring your security team. Early, not late.
The questions they will ask are the questions we would ask. We would rather answer them in the first meeting than have them surface in procurement.
Built and operated under SOC 2 audited controls.