Security & GDPR
This page is maintained by skole.bot to answer common security and privacy questions. It describes the platform's controls — your school's DPA defines the contract.
Data residency
All data is stored and processed exclusively on European infrastructure (Hetzner, OVHcloud, Scaleway). No data is transferred outside the EU/EEA.
No training on your data
Student and teacher conversations, uploads and prompts are never used to train AI models. This is contractually guaranteed.
Encryption
TLS 1.3 in transit. AES-256 at rest. Encrypted backups with 30-day retention.
Access control
Role-based access: students, teachers, admins. School-scoped multi-tenancy with strict row-level security.
Audit logs
Every sign-in, AI request, export and admin action is logged for at least 12 months and exportable on demand.
Data subject rights
1-click data export and account deletion for every user. Full DSAR support for schools.
Subprocessors
- Hetzner Online GmbH (DE) — hosting
- Lovable Cloud — managed Postgres / auth (EU region)
- Mistral AI (FR) — model provider, no training opt-in
This is illustrative copy intended to be edited by the school's data protection officer. skole.bot does not claim independent certification on this page.