Your institution's data is logically isolated and is not used to train Coursekit's own models.
Institutional data is logically isolated per tenant. Cross-institution data access is prohibited by application design.
Institutional prompts, documents, and student interactions are not used to train Coursekit-owned AI models. Customer-configured model providers are governed by institutional agreements and provider DPAs.
AI features run within institution-scoped security boundaries, including budget controls and configurable model access.
Governance-relevant actions are recorded in an append-only compliance audit log retained for institutional review.
User-submitted text to AI features is scanned for common PII patterns before being sent to external models; blocked submissions are logged.
Policy acknowledgments are timestamped and stored for accreditation and audit review.
Coursekit scans student-submitted messages in AI-powered chat for common protected-information patterns — such as email addresses, Social Security numbers, phone numbers, and student ID formats — and blocks them before they reach external AI models. Every outbound AI payload that contains student content is also scanned; detections are logged in the compliance audit trail. Institutions should still avoid placing raw PII in uploaded course materials.
Governance-relevant actions — including policy acknowledgments, credential access, PII blocking events, AI session reviews, and data exports — are recorded with timestamps, user identity, role, institution, and action context. Audit entries are append-only, enforced at the database level; the platform does not expose edit or delete operations for compliance audit rows.
Coursekit is designed to support institutional compliance with FERPA, state data privacy regulations, and accreditation standards. Each institution's data remains within its designated tenant boundary. Coursekit does not sell institutional data or use it for purposes outside the contracted service scope.