Security

How Edu Studio AI protects school data — concretely, not vaguely.

Draft policy. Edu Studio AI is onboarding pilot schools; this document describes our working practices and will be finalized with legal review before general availability. Last updated: October 2026.

Tenant isolation

Every API request is authorized against the caller's verified membership in the specific school — never against links or IDs supplied by the browser. Automated security tests prove that one school's administrators cannot read or modify another school's records.

Authentication

Passwords hashed with Argon2id; no plaintext storage, ever.
Opaque session tokens stored hashed; sessions are listable and revocable per device.
Login rate limiting and automatic lockout after repeated failures.
Password resets invalidate all existing sessions.

Authorization

Six roles with a server-enforced permission matrix. Teachers act only within their assigned classes and subjects; students only within their enrollments; parents only on children linked by the school. Hiding a button is never the security boundary.

AI safety controls

AI provider keys live only on the server — never in apps or browsers.
Per-user daily AI limits with a complete usage ledger.
Teacher review gates on AI-generated classroom content.

Accountability

Sensitive actions — role changes, enrollment, grade publication, payments, guardian links — write audit-log entries recording the actor, action and time.

Responsible disclosure

Found a vulnerability? Contact us through the contact page with “Support” as the topic. We take every report seriously and will credit researchers who report responsibly.