Security & data
We’re an early company, so this page describes how the system is actually built rather than which certifications we hold — because we don’t hold any yet, and we’d rather say so here than in a procurement review.
This is the question every program director asks first, so it goes first.
A lecture, deck or reading goes from your browser to our server. It is never written to a database, and never sent to a third party other than the model provider below.
Under 20MB, the file is held in memory and passed inline — the bytes never touch disk. At 20MB and above, it goes to a private bucket of ours, referenced only for the length of the run and deleted once that run is finished with it.
We deliberately do not use the Gemini Developer File API, which retains uploads for around 48 hours. Everything runs through Vertex AI instead, specifically so your material isn’t sitting in someone else’s storage.
What persists is the course you assigned and the responses your students give it. Not the source file.
Every model call is made server-side with credentials that are structurally unable to be imported into client code. There is no API key in the page, so there is none to extract.
Database rules — not just application code — decide who can read what. An instructor sees their organization; a student sees their own work. Those rules have their own automated test suite that runs against a live database emulator.
The fine-grained stream of student interactions cannot be edited or selectively deleted after the fact — database rules refuse the write, not just application code. Nobody can quietly rewrite what a cohort actually did, including us.
Course distribution links are time-limited rather than permanent URLs that keep working for anyone who ever saw them.
Typefaces are served from our own domain, so loading this site does not tell a font CDN who you are. We use Mixpanel for product analytics — disclosed in our privacy policy and on our subprocessor register, and it honours Do Not Track. No advertising trackers, no session recording, no data brokers.
Contrast, focus states and reduced-motion behaviour are held to AA as the design target for a tool instructors use daily. We audit against it; we do not claim a completed certification.
You are going to ask your IT department about us, and they are going to ask for these. Here they are up front, so nobody wastes a call finding out.
If one of these is a blocker for your institution, tell us which — it’s useful information about what to build next, and we’ll give you a straight answer about timing rather than a maybe. Write to support@adaptlearning.io.
Our privacy policy, terms and subprocessor list cover both the mobile app and institutional use of the portal, including our role as a processor for student data. An Enterprise Master Services Agreement and a FERPA Data Processing Addendum are available for procurement review on request.
Bring them to us early — we’d rather answer them now than have them surface after a pilot has started. And nothing on this page needs a signature first: you can set a program up yourself and see exactly what it stores.
