Data Privacy and AI Governance
How Coursekit and Studian handle data for institutions, faculty, and students — privacy, security, AI governance, and the formal legal documents universities need for procurement.
Our Data Privacy Commitments
Institution-Controlled Data
When an institution deploys Coursekit or Studian, student data remains under the institution's ownership and direction. We act as a service provider operating on the school's behalf.
No Sale of Student Data
Student personally identifiable information is never sold, licensed, rented, or otherwise monetized. This is an absolute commitment, not a preference.
No Targeted Advertising
Student data is never used for advertising, behavioral profiling, or marketing of any kind — inside or outside the platform.
Purpose-Limited AI Use
AI features operate exclusively within the educational context defined by the institution and faculty. Student AI interactions are auditable by instructors.
FERPA-Aligned Institutional Use
Coursekit and Studian are designed to support FERPA-aligned practices when deployed by postsecondary institutions.
Coursekit and Studian are designed to operate as school-directed education technology services. When an institution uses the platform with students, The AI Systems Architect LLC acts as a third-party service provider under the direction and control of the institution.
Student data is used only to provide, maintain, secure, and improve the contracted educational services, and is not sold or used for unrelated advertising purposes.
Key Positions
- Our role: third-party service provider operating under institutional direction
- School control: the institution determines how and why student data is used on the platform
- Legitimate educational purpose: data is processed solely to deliver the educational service authorized by the institution
- No unauthorized redisclosure: student personally identifiable information is not disclosed to unauthorized third parties
- Data return and deletion: data can be returned, exported, or deleted according to institutional instructions
- Subprocessors: all third parties that may process data are disclosed and listed
How AI Is Used with Student Data
AI is central to how Studian supports students. Here is exactly what happens with student data when AI features are used.
What data may be sent to AI models
- Student prompts and messages within AI chat sessions
- Prior session history for context continuity
- Assignment title, instructions, and professor-defined AI guidance
- Course materials relevant to the assignment context
- Persistent learning memories (learning style, misconceptions, progress) generated from prior sessions
- Session notes summarizing the current learning state
What is NOT sent to AI models
- Student email addresses, names, or account identifiers are not injected into AI prompts
- A PII scanner runs on student chat input before it reaches the model, blocking patterns like email addresses, phone numbers, SSN formats, student IDs, GPA, and disability references
- Blocked messages are logged in a compliance audit trail and never forwarded to the AI provider
AI Providers
Student-facing Studian chat is powered by institution-approved model providers (commonly OpenAI; institutions may also enable DeepSeek, Groq, xAI, Anthropic, or Google via AI Settings) through server-side API calls. Providers' API data-usage policies typically exclude API traffic from model training; institutions should confirm DPA terms for each enabled provider.
Professor curriculum tools may use additional providers (Anthropic, Google, Mistral, and others) via professor-supplied API keys. BYOK curriculum traffic is separate from student Studian chat unless the institution configures otherwise.
Institutional AI Controls
- Professors define AI boundaries per assignment: allowed topics, restricted areas, and permission modes
- Faculty can review student AI session metadata and flags via Studian Monitor
- Institutions can configure approved AI models and restrict provider access
- All AI interactions occur within governed workspaces, not open-ended consumer AI
Data Inventory
A summary of the categories of data collected and processed by the platform.
| Category | Examples | Purpose |
|---|---|---|
| Account data | Name, email, role, institution affiliation | Authentication, permissions, role-based access |
| Course data | Course title, syllabus, assignments, AI prompts | Curriculum delivery and assignment management |
| Student AI sessions | Chat messages, AI responses, session notes, learning memories | AI-assisted learning within governed workspaces |
| Assignment data | AI workspace interactions, assignment context | Assignment support and faculty review |
| Learning artifacts | Flashcards, study plans, skill progress, assessment attempts | Student study tools and competency tracking |
| Enrollment data | Course enrollments, invitation records, enrollment codes | Student-course relationships and access control |
| Credentials | Issued certificates, competency mastery records | Institutional credentialing and verification |
| Usage and security logs | Login events, audit logs, LLM token usage | Security monitoring, troubleshooting, cost tracking |
Security Practices
Current technical and organizational safeguards protecting platform data.
Encryption in Transit
All connections use HTTPS/TLS. API communication with AI providers is encrypted end-to-end.
Managed Database
Data is stored in DigitalOcean managed PostgreSQL with SSL connections and automated backups. Production deployments should supply a CA certificate for strict TLS verification.
Authentication
Secure login via NextAuth with JWT sessions and bcrypt password hashing. SSO/SAML integration is on the roadmap.
Role-Based Access Control
Eight-tier role hierarchy from platform admin through learner. Granular permissions control access to analytics, user management, and reporting.
Tenant Separation
Institution-scoped data isolation through institution ID foreign keys. Professors see Studian sessions only for courses they teach and students enrolled in those courses; students access only their own sessions.
PII Protection
Regex-based PII scanner blocks common sensitive patterns in user-submitted AI chat text (emails, SSNs, phone numbers, student IDs). Blocked attempts are audit-logged.
Least Privilege
Internal access is limited to necessary personnel for support, security, and authorized operations only.
Audit Logging
Governance-relevant events (credential issuance, PII blocking, policy changes, data exports) are recorded in an append-only compliance audit log.
Hosting on a SOC 2 Type II infrastructure provider
Coursekit and Studian run on DigitalOcean (application droplets and managed PostgreSQL in the United States). DigitalOcean maintains SOC 2 Type II and SOC 3 Type II attestations for its infrastructure. Those reports cover DigitalOcean's controls — physical facilities, hypervisor, and managed platform — not Coursekit or Studian as products. We are not ourselves SOC 2 attested; that work is on our roadmap.
Current DigitalOcean reports are kept on file under NDA and can be shared with institutions under NDA on request. Public details:
Request the NDA-restricted Type II report: [email protected]. We do not publish DigitalOcean's SOC 2 report on this site.
Data Retention and Deletion
How long data is retained and how institutions can request its removal.
Student-Initiated Deletion
Students can delete their own course-scoped data — including AI session records, session notes, learning memories, flashcards, and study plans — directly from the platform.
Automated Retention (TTL)
Institutions configure Studian session retention (default 365 days from session start) under AI Settings. Expired, unflagged sessions and their messages are purged automatically; flagged sessions are retained for review. Temporary account-export files are removed after 7 days. Deletion events are written to the compliance audit log.
Institution-Requested Deletion
Upon written request from an authorized institutional administrator, The AI Systems Architect LLC will export, return, delete, or de-identify institution-controlled data within a commercially reasonable period, unless retention is required by law, security obligations, dispute resolution, or backup processes.
Contract Termination
At the end of a contractual relationship, institution data will be returned or securely deleted according to the terms of the applicable agreement. Backup copies are purged within 90 days of primary deletion.
Subprocessors
Third-party services that may process institution or student data on behalf of the platform.
| Subprocessor | Purpose | Data Processed |
|---|---|---|
| DigitalOcean | Cloud hosting, managed PostgreSQL database | All platform data (encrypted at rest and in transit) |
| OpenAI | Student AI chat, session analysis, learning memory generation (default student path) | Chat messages, assignment context, learning memories (API terms typically exclude training use) |
| DeepSeek / Groq / xAI (when enabled) | Optional institution-approved student or faculty model routes via AI Settings | Prompt and completion content for enabled routes — confirm each provider DPA |
| Anthropic, Google, Mistral, and others | Professor curriculum AI tools and optional institution routes (keys may be platform or BYOK) | Course materials and prompts; student chat only when that provider is selected for Studian |
| Tavily | Web research for curriculum generation | Search queries related to course topics — no student data |
This list reflects current production subprocessors. Institutions will be notified of material changes. See the formal subprocessor registry for the live procurement list.
Data Privacy Agreements
We are prepared to enter into formal data privacy agreements with institutions deploying Coursekit or Studian.
- A Student Data Privacy Agreement (DPA) template is available covering definitions, permitted and prohibited uses, data ownership, confidentiality, breach notification, and termination obligations
- Institution-specific DPAs can be negotiated to meet local procurement and compliance requirements
- The full FERPA / Student Data Privacy Readiness Packet is available upon request, including detailed data inventory, security documentation, incident response plan, and access control policies
- Cyber insurance and additional procurement documentation can be obtained as required by institutional procurement processes
Formal Legal Documents
Same trust center — formal drafts for university counsel. Plain-language commitments above; enforceable instruments below.
Terms of Service
Institutional and end-user terms for Coursekit and Studian.
Open →Privacy Policy
Legal-grade policy for how we collect, use, and protect data.
Open →Cookie Policy
First-party auth and security cookies only — no ad trackers.
Open →Subprocessor registry
Live list of infrastructure, email, and AI providers.
Open →Data Processing Agreement
FERPA school-official / SDPC NDPA–aligned DPA outline.
Open →Governance
Data isolation pledge, PII shielding, and audit trail.
Open →Request counsel-reviewed PDFs, COI, and HECVAT responses: [email protected]
Compliance Roadmap
We are transparent about where we are today and where we are headed. Coursekit and Studian are early-stage products building toward full institutional readiness.
Current
- Student data privacy principles and published position
- Data inventory and AI data-use documentation
- PII scanning on student AI interactions
- Role-based access control with 8-tier hierarchy
- Compliance audit logging
- Incident response plan
- DPA template available for institutional review
- DigitalOcean SOC 2 Type II report on file (infrastructure host; available to institutions under NDA)
Before First Institutional Deployment
- Finalized subprocessor list with full security details
- Institution-specific DPA execution
- Cyber liability insurance
- Independent security review
Roadmap
- SOC 2 Type I readiness assessment
- Penetration testing by qualified third party
- SSO/SAML integration for institutional identity providers
- Advanced audit logging and data access reporting
- Formal vendor risk management program
Coursekit and Studian have not yet completed SOC 2 certification. We host on DigitalOcean, which maintains SOC 2 Type II for its infrastructure (see Hosting). We are building toward our own attestation and do not claim certifications we have not earned.