Data protection

Your research stays yours

Custard is built for commercialization work that can include unpublished research, invention disclosures, interview transcripts, stakeholder information, and generated analyses. This page states six verifiable principles for how that data is handled - each backed by controls that exist in the product today - and links to our Trust Center for the detail university security and procurement reviewers need.

Six verifiable principles

Your research and institutional data stay under your control

These are not aspirations - they are commitments you can verify against the product and the Privacy Policy. The Trust Center on our security page has the full detail behind each one.

  • You own your work and IP. You retain ownership of your research, intellectual property, and content - uploaded files, interview recordings and transcripts, project notes, prompts, generated analyses, contact lists, and project metadata. Custard receives only the limited rights needed to operate, secure, and support the service.
  • Your content is not AI training data. Custard does not use your content to train or fine-tune any model - ours or anyone else's. Platform AI runs through Amazon Bedrock under a zero-retention arrangement, and any other AI provider processes your content only to perform the requested function, under terms that prohibit training on customer data. If you configure a bring-your-own AI provider, that processing runs under your agreement with that vendor instead.
  • Access is scoped by account, role, and project. Server-side authorization restricts every read and write to the users and projects that have been granted access - verified on the server on every request, not in the interface. Private files are delivered through controlled, time-limited access rather than permanent public links, and security-relevant activity lands in an append-only audit trail.
  • Data is encrypted and stored privately. Your content is encrypted in transit (TLS) and at rest, and every uploaded object is private by default. Data is stored in the United States on infrastructure provided by Replit and Google Cloud, and stored API keys are encrypted with AES-256-GCM.
  • Retention and deletion are defined. You can delete projects, recordings, and transcripts from within the product - deleted project content leaves active systems immediately and encrypted backups within 30 days. Account deletion is by request to privacy@mira-insight.com, with account data such as backups and audit logs retained for up to 90 days, and scheduled sweeps purge stale personal data on fixed timetables.
  • Subprocessors are disclosed. The Privacy Policy names every third-party provider that may process your data and what each one is for, with at least 30 days' notice before a new sub-processor is added. University security-review materials - including completed vendor-assessment answers - are available on request through the Trust Center.

The full detail is in the Trust Center

These six principles are the summary. The Trust Center on our security page is the working layer for reviewers: approved and prohibited data categories, the AI provider and sub-processor register, the retention and deletion schedule, security-review materials available on request, and how to report a security concern.

Open the Trust Center

How Custard handles your research data.

Plain answers to the questions teams ask most about how Custard uses AI and treats customer data.

Does Custard use my research data to train AI models?
No. Your research content - interviews, notes, documents, analysis - is never used to train or fine-tune any AI model. This is a hard contractual and technical commitment, not just a policy statement.
Which AI providers process my data?
By default, Custard routes AI work through Amazon Bedrock, which has a zero-retention agreement: data sent to Bedrock is not stored, logged, or used by Amazon after your request completes. For certain features Custard may also use OpenAI under a data-processing agreement that prohibits training on customer data.
What is the "Bring Your Own Provider" option?
Teams on eligible plans can configure their own AI provider - an OpenAI-compatible endpoint or Anthropic - in account settings. Custard processes your request and sends your project content to the provider you chose, where it is handled under your agreement with that vendor and its terms. Our zero-retention and no-training commitments apply to the platform default provider only, as described in the Privacy Policy.
Can my research leak while I iterate?
No. Every outbound call from the platform passes through a single server-side gate that scans prompts for secrets and PII, blocks disallowed destinations, and governs background jobs exactly like live requests. Platform AI runs zero-retention, so you can keep iterating without your research being stored anywhere or training any model.
What happens when I connect Google Drive, Zoom, or Outlook?
Custard reads only the files or meetings you explicitly import. We don't index or cache your entire account. OAuth tokens are stored encrypted and can be revoked from your settings at any time.
Can I delete my data?
Yes. You can delete individual projects, recordings, and transcripts from within the product; deleted project content is removed from active systems immediately and from encrypted backups within 30 days. To close and delete your entire account, email privacy@mira-insight.com - personal information is deleted within 30 days of account closure, and account data such as backups and audit logs is retained for up to 90 days, as described in the Privacy Policy.
Does Custard sell or share my data with third parties?
Never. Custard does not sell personal information, share it for cross-context advertising, or provide it to data brokers. Third-party sub-processors (like Bedrock or OpenAI) receive only the minimum data needed to complete a specific operation.
Where is my data stored?
Custard stores data in the United States on infrastructure provided by Replit and Google Cloud. Enterprise customers with specific residency needs should contact the team.
Who at Custard can access my research data?
Access is strictly limited to engineers investigating a specific support issue, and only with your permission or when legally required. We do not routinely read customer research content.
How are AI-generated outputs labelled?
Every AI-generated insight, suggestion, or analysis in the product is marked with an "AI" badge so you always know what came from a model versus a human. You stay in control of what gets saved and shared.
What security practices protect my data?
Data is encrypted in transit (TLS) and at rest. Security-relevant events are recorded in an append-only audit trail. File uploads are validated for safety before being stored.
Where can I read the full legal detail?
The complete Privacy Policy is at /privacy and the Terms of Service are at /terms. If you have a specific question not answered there, email privacy@mira-insight.com.

Want the complete legal detail? Read the Privacy Policy / Read the Terms of Use