Data residency

Primary data — accounts, courses, progress and uploads — is stored in the European Union (Frankfurt, Germany). Where a sub-processor operates outside the EU/EEA, transfers are covered by a Data Processing Agreement and EU Standard Contractual Clauses (SCCs). See the sub-processors list below.

Security measures

Area	Control
Encryption	TLS 1.2+ in transit everywhere; data encrypted at rest at the database and storage layer.
Tenant isolation	PostgreSQL Row Level Security on every table isolates each school’s data; cross-tenant access is only possible through audited, service-role admin paths.
Authentication	Hashed credentials, optional Google SSO, and email-based 2FA with 30-day device trust on the admin/creator zone.
Least privilege	The public client is read-only; all mutations go through server-side handlers with input validation. Service-role keys never reach the browser.
File access	Private uploads (e.g. submissions) are served via short-lived signed URLs, not public links.
Hardening	Rate limiting on authentication endpoints, secret management outside the codebase, and bot/abuse protection at the edge.

Sub-processors

We use a small set of vetted providers to deliver the service. We update this list before adding or replacing a sub-processor that handles personal data.

Sub-processor	Purpose	Region	Safeguard
Supabase	Database, authentication, file storage	EU — Frankfurt, Germany	EU hosting; DPA
Bunny.net (Bunny Stream)	Video hosting, captions delivery, CDN	EU + global edge	DPA; SCCs
Cloudflare	DNS, CDN, TLS, WAF / bot protection	Global edge	DPA; SCCs
Emailit	Transactional & academy email delivery	EU	DPA
Stripe	Payments and billing	EU / US	DPA; SCCs; PCI-DSS
OpenAI	Speech-to-text (automatic captions)	US	DPA; SCCs; no training on our data
Google	Optional sign-in (OAuth) and, with consent, Analytics	US	DPA; SCCs; consent-gated
Hosting (self-managed, Coolify)	Application runtime	EU	EU data centre

Data processing agreement (DPA)

A GDPR Article 28 Data Processing Agreement, including the sub-processor list and EU Standard Contractual Clauses, is available for signature on request. Email info@eduspera.com. The data controller and contracting entity is Design Excellent Group SL (NIF B02759603), Calle Blanquerna 53, 07003 Palma de Mallorca, Spain.

Backups & resilience

Continuous database backups with point-in-time recovery.
Recovery objectives: RPO ≤ 24h, RTO ≤ 8h for a major incident (targets, kept under review as we formalise our SLA).
Infrastructure is reproducible from version control and deploys through an automated pipeline.

Incident response

We maintain an incident-response process. In the event of a personal-data breach, we will notify affected controllers/customers without undue delay and, where required, within 72 hours of becoming aware, in line with GDPR Article 33.

Responsible disclosure

If you believe you have found a security vulnerability, please report it to info@eduspera.com. We will acknowledge your report, keep you updated, and we will not pursue or support legal action against good-faith research that respects user privacy and avoids service disruption.

Compliance & accessibility

GDPR — EU data residency, DPA available, data-subject rights honoured (see Privacy Policy).
Accessibility — WCAG 2.2 Level AA as a product requirement; see our Accessibility Conformance Report (VPAT/ACR).
SOC 2 — on our roadmap; a formal programme will be initiated to support enterprise customers. We are happy to complete security questionnaires (e.g. CAIQ-Lite) in the meantime.

Higher education security questionnaire (HECVAT)

Universities assess vendors with the EDUCAUSE HECVAT. We publish the substance of our answers — hosting and data location, tenant isolation, encryption, backups, incident response, SSO and SCIM, audit logging, FERPA and attestations — so a security reviewer can qualify us before the questionnaire is ever sent. Where we do not meet an expectation yet, we say so.

HECVAT Lite is completed and available under NDA. See our full HECVAT answers, or email info@eduspera.com from an institutional address and we will send the document together with the security one-pager. Institutions planning a pilot can start from the university pilot kit.

Documents

Accessibility Conformance Report (ACR / VPAT) — published at /accessibility/conformance; WCAG 2.2 AA, EN 301 549 and Section 508, self-assessed, third-party audit in progress.
Data Processing Agreement (DPA) — GDPR Article 28, with a FERPA “school official” clause for student records; on request at info@eduspera.com.
HECVAT Lite — on request under NDA; public summary of the answers at /trust/hecvat.
Security one-pager — a one-page summary of the controls on this page; on request.

Compliance documents

Everything below is generated from the product repository and re-issued with each release, so it is never older than the software it describes.

Document	What it is
Accessibility Conformance Report (PDF)	ITI VPAT® 2.5 INT — WCAG 2.2 A/AA, EN 301 549 and Section 508. Report version 2.0, 2026-09-03, product version 0.1.0. Also readable at /accessibility/conformance.
Accessibility changelog	Every accessibility-relevant change shipped, with the WCAG success criteria it affects.
System status	Live checks of the application, database/authentication and video delivery; incident history once external monitoring has collected real data.
Retention & erasure	Account holders can export their own data (JSON, audit-logged). Approved erasure requests anonymise the profile and sign-in identity, remove supported files, private preferences and accessibility declarations, and revoke sessions. A receipt records the completed changes after required cleanup succeeds. Payment, invoice and academic records, signed documents and immutable contractual evidence are retained only as needed for applicable obligations and the academy’s documented policy, with anonymised references where permitted. Community posts remain available with an anonymised author. Each academy must document the legal basis and duration of its retention exceptions. Audit logs are append-only and follow the academy’s configured retention schedule. Details in the Data Classification & Handling Policy.
SOC 2 readiness	Policies are in place and published below; controls (change management through reviewed pull requests and CI, immutable audit log, 2FA-gated admin zone, encrypted secrets vault, vendor DPAs, EU hosting) are operating. A SOC 2 Type I audit is commissioned on contract with the first customer that requires it, followed by Type II after the observation period.

Policies

Access Control Policy — Who can reach production systems and customer data, how access is granted, verified and removed.
Business Continuity & Disaster Recovery Policy — How the service keeps running or is restored after a major failure.
Change Management Policy — How code and infrastructure changes are proposed, reviewed, tested and deployed.
Data Classification & Handling Policy — What kinds of data we hold, how sensitive each is, and the handling rules that follow.
Incident Response Policy — How security incidents and personal-data breaches are detected, handled and communicated.
Vendor Management Policy — How we choose, contract with and review the providers that process customer data.

Contact

Security, privacy and data requests: info@eduspera.com