Security & data
We’re an early company, so this page describes how the system is actually built rather than which certifications we hold — because we don’t hold any yet, and we’d rather say so here than in a procurement review.
This is the question every program director asks first, so it goes first.
A lecture, deck or reading goes from your browser to our server. It is never written to a database, and never sent to a third party other than the model provider below.
Under 20MB, the file is held in memory and passed inline — the bytes never touch disk. Over 20MB, it goes to a private bucket of ours, referenced for the length of the run and deleted the moment that run ends.
We deliberately do not use the Gemini Developer File API, which retains uploads for around 48 hours. Everything runs through Vertex AI instead, specifically so your material isn’t sitting in someone else’s storage.
What persists is the course you approved and the responses your students give it. Not the source file.
Every model call is made server-side with credentials that are structurally unable to be imported into client code. There is no API key in the page, so there is none to extract.
Database rules — not just application code — decide who can read what. An instructor sees their organization; a student sees their own work. Those rules have their own automated test suite that runs against a live database emulator.
The fine-grained stream of student interactions carries an expiry of 30 to 90 days and is append-only: it cannot be edited or selectively deleted after the fact. Aggregates are what persist.
Course distribution links are time-limited rather than permanent URLs that keep working for anyone who ever saw them.
Typefaces are served from our own domain, so loading this site does not tell a font CDN who you are. We do use Mixpanel for product analytics, which is disclosed in our privacy policy and honours Do Not Track.
Contrast, focus states and reduced-motion behaviour are held to AA as the design target for a tool instructors use daily. We audit against it; we do not claim a completed certification.
You are going to ask your IT department about us, and they are going to ask for these. Here they are up front, so nobody wastes a call finding out.
If one of these is a blocker for your institution, tell us which — it’s useful information about what to build next, and we’ll give you a straight answer about timing rather than a maybe. Write to support@adaptlearning.io.
Our privacy policy, terms and subprocessor list cover both the mobile app and institutional use of the portal, including our role as a processor for student data. An Enterprise Master Services Agreement and a FERPA Data Processing Addendum are available for procurement review on request.
Bring them to the demo call. We’d rather answer them early than have them surface after a pilot has started.
