We do not use any input, output, or personal information to train third-party service provider AI technology.
Where we stand
We don’t use your inputs, outputs, or personal information to train third-party AI providers. Creatium is built to comply with GDPR and UK GDPR, along with privacy laws in Canada, Australia, New Zealand, South Africa, and 20 US states.
We disclose every AI subprocessor we rely on (including Anthropic, OpenAI, ElevenLabs, Cartesia, Perplexity, and AWS and Azure AI) and apply human review to AI-generated content in our services work.
We align to GDPR, UK GDPR, and FERPA. We only list certifications we can produce evidence for. See the certifications below, and ask us anytime.
We conform to WCAG 2.1 AA and Section 508, with captions, screen-reader support, and respect for system preferences like reduced motion. A VPAT is available on request.
Coach content is SCORM-compliant and distributes through your LMS with progress tracking, centralized content management, and learning-path delivery.
Certifications & conformance
What we can produce evidence for today. Ask and we’ll share the report, DPA, or VPAT.
ISO 27001 certified for information security management and ISO 27701 for privacy information management.
Built to comply, with a Data Processing Addendum available for customers.
Supports FERPA obligations for customers handling student education records.
Conformant, with captions and screen-reader support. A VPAT is available on request.
Access and custody stay with you
Only your administrators grant access. They invite members by email with a defined role, see the full member list, and remove members at any time.
Enterprise single sign-on with SAML. Sign-in is restricted to the email domains you nominate, and account creation can be configured so only people your administrators have invited are able to sign in.
Creatium personnel have no access to your content without your permission.
Published content can optionally be placed only in storage you own and administer. You grant scoped credentials and can rotate or revoke them at any time.
How we handle AI and your data
We never use your inputs, outputs, or personal information to train third-party AI.
We engage only providers that commit to the same in writing, and the current list is available on request.
Every AI subprocessor we use is disclosed in our privacy notice.
AI-generated content in our services work is reviewed by a human.
Avatars are used only with consent from the individuals or their estates, with consultation for Indigenous communities.
What we commit to contractually
A Data Processing Agreement and Data Handling Schedule form part of every contract.
Access controls, encryption in transit and at rest, logical segregation, vulnerability management, and logging and monitoring.
We’ll notify you without undue delay after becoming aware of a personal data breach affecting your data, with the information you need to meet your own compliance obligations.
You specify what is deleted and when, for a single project or your whole workspace. We carry it out within the period set out in the agreement and confirm in writing. On termination we delete your content within 60 days, plus standard backup retention of up to 90 additional days, after which backups are overwritten.
At least 30 days’ notice before we add a new subprocessor, with the right to object on reasonable grounds.
On reasonable notice, we’ll provide the information needed to demonstrate compliance, and permit an on-site audit once every 12 months.