Built to survive an audit, not just a demo.
Regulated teams in finance, health and government run on Curratto. Here is exactly how we handle your data, hold the line on policy, and hand your auditors something they can point at.
The short version: we hold less of your world than most vendors.
Curratto curates content instead of hosting it, so the courses live where they always have, with their original providers. What we keep is deliberately small: the links, the metadata, your policies, and your team's progress. Less to secure, and far less to explain when someone asks.
Curratto stores links and metadata, not copies of the courses. Learners open content on the original provider, so we never become a second, unlicensed home for someone else's material.
Each workspace inherits a blueprint. Locked policies cannot be turned off by an admin or an agent, and only cleared sources can ever be curated.
Screening choices, assignments and credential issuance are written to an audit trail with the source each acted on. You can export it as a signed record.
Single sign-on over SAML or OIDC, role-based permissions, and least-privilege defaults. People see the workspace and data their role allows, nothing more.
Traffic runs over TLS and stored data is encrypted at rest. Secrets and API keys are scoped, rotatable and never shown in full after creation.
We collect the minimum needed to run learning. You can export your data at any time, and deletion on request removes it from our systems and backups on a defined schedule.
Where we stand, stated plainly.
No vague badges. Here is the real status, and we are happy to go deeper under an NDA.