Where each tool is actually private.
CitaviMendeley
Training on your dataPartialPartial: Lumivero AI Terms 1.3 says customer data and inputs will not train or improve models in a form that retains or is derived from identifiable customer information. This is a qualified restriction, not a blanket promise that no input ever trains a model. Terms 1.6 allows processing to provide, secure and improve AI services within that restriction; separately selected third-party AI providers follow your agreement and settings with them. The University of Augsburg warns that AI training cannot be ruled out, which is its institutional assessment, not proof of actual training. Citavi-specific provider details and non-identifiable training use remain unverified. Source: Lumivero AI Terms, checked 12 Oct 2026 (linked in Sources).UnknownUnknown: Not recorded as a plan-wide guarantee. Check the dossier's privacy notes and sources.
EU data residencyPartialPartial: The manual places account and licence data in Azure West Europe (Amsterdam). Cloud projects and attachments use the Azure region nearest the user, with West Europe for Europe, Africa and the Middle East. That does not guarantee EU-only AI processing; Open Beta requests may leave the hosting region.UnknownUnknown: Not recorded as a plan-wide guarantee. Check the dossier's privacy notes and sources.
SOC 2 attestationUnknownUnknown: No Citavi-specific SOC 2 report was verified in this documentation check. Azure hosting and encryption in the technical manual are not proof of a Citavi SOC 2 certification.UnknownUnknown: Not recorded as a plan-wide guarantee. Check the dossier's privacy notes and sources.
Local-first by defaultPartialPartial: Windows desktop projects can stay local as SQLite files. Account login, updates and searches still contact external services; Citavi Web and optional AI processing are not local.UnknownUnknown: Not recorded as a plan-wide guarantee. Check the dossier's privacy notes and sources.