Security and data protection pack

1. About CurioPilot

• CurioPilot is a learning platform for schools and families, from KG to Grade 12, made by MoizLabs LLC.
• Schools use it for practice, marking, exam preparation, progress reporting and parent communication.
• For a school, the school is the data controller and MoizLabs is the processor, under a data processing agreement signed before any student data is added.

2. Where data is hosted

• All customer data — database, files, backups, logs and email — is stored in Microsoft Azure, UAE North region.
• AI requests run on Microsoft Azure OpenAI. A request may be processed in another Azure region; nothing is stored there.
• Backups are encrypted and stay in the UAE.

3. How data is protected

• Encryption in transit (TLS) and at rest, including backups.
• Each school’s data is kept separate in the database itself; one school cannot read another’s. This is tested on every release.
• Secrets for school integrations are stored encrypted, with keys held in Azure Key Vault.
• Staff sign in with a password with lockout, optional two-step sign-in (which a school can make mandatory), or single sign-on.
• Young children on shared tablets sign in with their name and a PIN, on a device an adult has set up.
• Access is role-based and closed unless granted: teachers see their own classes; parents see their own children.

4. AI safeguards

• Before any AI request, CurioPilot checks the school’s AI settings and, for children under 13, a parent’s consent.
• Names, emails and other personal details are removed before anything is sent to the AI.
• Children’s work is never used to train AI models.
• Teachers review AI-written activities before students see them, and can change any AI-suggested mark.
• Every AI suggestion is recorded — what was suggested, for whom, why and who approved it — and schools can search and export the record.
• Student writing is checked for signs of distress with fixed, reviewable rules, and serious cases alert the school.

5. Privacy law

• Built to the principles of the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021).
• GDPR: a data processing agreement under Article 28; access, correction, export and erasure supported.
• COPPA: AI features stay off for children under 13 until a parent gives consent.
• FERPA (US schools): CurioPilot acts as a school official under the school’s direction.

6. Incidents

• A written incident plan: detect, assess, contain, notify, review.
• Affected schools are told within 24 hours of an incident being confirmed; regulators within the time the law requires.

7. Keeping and deleting data

• Data is kept only while the school or family uses CurioPilot.
• Schools can export their data at any time.
• When an account closes there is a 30-day window to change your mind; then the data is deleted, and backups are cleared within 90 days.
• Records of AI suggestions are kept for 90 days by default; security records are kept longer, as the law requires.

8. Certifications and testing

• CurioPilot runs on Microsoft Azure, which holds SOC 2 and ISO 27001 certifications.
• CurioPilot itself has not yet been independently audited. An independent security test is planned before general availability.

9. Services that handle data

As of 2026-10-14. Schools are told 30 days before a new service that handles their data is added.

10. Next steps

• Request the data processing agreement or send your security questionnaire through curiopilot.com/contact.
• Read more: curiopilot.com/security and curiopilot.com/tracelayer.