Skip to main content
Curtly is engineered from the ground up for strict enterprise data isolation, privacy compliance, and latency-critical execution.

​
1. Zero Data Retention (ZDR) Architecture

Volatile RAM Processing

All prompt parsing, AST token isolation, and compression algorithms execute strictly in ephemeral memory. No payload text is ever written to disk or persistent databases.

Zero Model Training

Your prompts, RAG context, and completion outputs are never used to train, fine-tune, or evaluate machine learning models.

​
2. API Key Scopes & Types

Curtly provides scoped credentials for development and production workloads:

​
3. Transport Security & Network Isolation

  • TLS 1.3 Strict: All traffic to curtly.dev and api.curtly.dev is encrypted in transit using TLS 1.3 with modern cipher suites.
  • Timing-Safe Key Verification: Proxy key verification uses constant-time string comparisons to prevent side-channel timing attacks.
  • DDoS & Rate Limiting: Edge infrastructure automatically shields endpoints from abusive traffic and distributed denial-of-service attempts.

​
4. Compliance & Enterprise Deployments

Curtly is designed to comply with standard enterprise data protection frameworks:
  • GDPR & CCPA Compliant: Since no personal data or customer prompt content is persisted, privacy compliance is built-in by design.
  • Self-Hosted & VPC Options: For air-gapped environments or strict data sovereignty rules, Curtly Proxy can be deployed as an in-VPC container.