Data Security & Privacy Policy

Our Security Commitment

EduVerse operates under a zero-trust security architecture, meaning every user, device, and network connection is verified before accessing our educational platforms. We understand that educational data is highly sensitive, especially when it involves minors and institutional records. Our security framework is continuously audited, updated, and aligned with global best practices.

Data We Collect & Why

We collect and process data strictly to deliver, improve, and secure our educational services. All data processing is grounded in legitimate interest, contractual necessity, or explicit consent.

How We Protect Your Data

Our infrastructure is built on defense-in-depth principles, combining technical controls, administrative policies, and physical safeguards.

• End-to-End Encryption: All data in transit is protected via TLS 1.3. Data at rest uses AES-256 encryption across all databases and backups.
• Multi-Factor Authentication (MFA): Mandatory for staff accessing student records. Optional but highly recommended for all learner accounts.
• Role-Based Access Control (RBAC): Staff access is strictly limited to minimum necessary privileges. Instructor access is scoped to only their enrolled students.
• Regular Penetration Testing: Quarterly third-party security audits and vulnerability assessments conducted by certified cybersecurity firms.
• Secure Development Lifecycle: All code undergoes static/dynamic analysis, peer review, and automated dependency scanning before deployment.

Compliance & Certifications

EduVerse adheres to strict regulatory frameworks to ensure lawful, ethical, and transparent data handling across all jurisdictions we operate in.

• ✅ FERPA (Family Educational Rights and Privacy Act): Full compliance for handling student education records in the United States.
• ✅ GDPR & CCPA/CPRA: Transparent consent management, data portability, and right-to-erasure workflows for EU and California residents.
• ✅ SOC 2 Type II: Independently audited controls for security, availability, processing integrity, and confidentiality.
• ✅ COPPA Compliance: Strict safeguards for users under 13, including parental consent verification and restricted data collection.
• ✅ ISO 27001:2022: Certified Information Security Management System (ISMS) governing our operational controls.

Your Rights & Data Controls

You maintain full ownership and control over your personal information. EduVerse provides self-service tools to exercise your rights without needing to contact support:

• Access & Export: Download a complete copy of your account data in JSON or CSV format via Settings → Privacy.
• Correction: Update inaccurate profile or contact information instantly through your dashboard.
• Deletion: Request full account and data erasure. Processed within 30 days, with legal/financial records retained only as required by law.
• Cookie & Tracking Control: Manage analytics and marketing preferences via our built-in consent manager.
• Parental/Guardian Access: Designated guardians can manage permissions, view progress, and request data removal for minor accounts.

Third-Party Services & Data Sharing

We partner with vetted service providers to enhance our platform. All third-party vendors are bound by strict Data Processing Agreements (DPAs) and undergo security due diligence.

We never sell, rent, or trade your personal data. Educational records are never shared with advertisers or data brokers.

Security Incident Response

Despite robust preventive measures, security incidents can occur. EduVerse maintains a 24/7 Security Operations Center (SOC) and a documented incident response plan aligned with NIST SP 800-61.

• Detection & Triage: Automated monitoring systems trigger alerts for anomalous activity, unauthorized access attempts, or data exfiltration patterns.
• Containment & Remediation: Isolated response protocols prevent lateral movement. Vulnerabilities are patched within 24 hours of verification.
• Notification: Affected users will be notified within 72 hours of confirmed breaches, detailing impacted data, potential risks, and protective steps.
• Post-Incident Review: Root cause analysis and policy updates are published transparently to prevent recurrence.

Questions or Concerns?

Our Data Protection Officer (DPO) and security team are available to address specific inquiries, process formal requests, or discuss institutional security requirements.