How we protect student and school data

Encrypted

Traffic is encrypted with TLS and browsers are told to use HTTPS only. Stored data is encrypted with AES-256.

Separated by school

Staff see only their own school. The school is taken from the signed-in session, and records are checked against it before they are shown.

Protected sign-in

Passwords are hashed, school passwords must be at least 12 characters, and sessions end after 8 hours.

Your school stays in control

Schools choose and reset their own passwords. Evalent staff cannot set a school user’s password for them in normal use.

Checked every day

An automated job checks critical secrets and database permissions every day and emails our team.

No training on your data

Our AI providers do not train their models on data we send through their APIs. Data is never sold.

Short-lived sensitive files

Voice recordings are deleted once processed. Original specialist documents are erased once summarised.

Honest about certification

Our providers hold SOC 2 and ISO 27001 certifications. Evalent does not yet hold its own, and has not yet had an independent penetration test.

Student records

Name, grade applied for, date of birth, gender, nationality, first language, and the reference your school assigns. Schools decide which students to register.

Assessment responses and results

Multiple choice answers, extended writing, Evalent scores, the written report generated for the student, and the decision your school records. Students complete the assessment in Evalent’s own assessment form.

Specialist documents

Schools can upload specialist reports (for example educational psychologist, speech and language, or occupational therapy reports) for Evalent to summarise. The original file is erased once the summary is produced. The summary stays with the school record and is visible only to that school. In Evalent Intelligence, the content of a specialist report is not copied across. Only a pointer to it is kept. The document is sent to our AI provider, Anthropic, to produce the summary.

Voice responses

Where a school uses a voice task, the recording is sent to OpenAI for transcription and then deleted from our storage as soon as processing finishes. We keep the transcript and the scores calculated from it.

School and staff accounts

Staff names, work email addresses, roles and the school they belong to. Passwords are stored only as one-way hashes. Evalent never stores payment card data. Payments are handled by Paddle as Merchant of Record.

Who can see it

Signed-in staff at the school that registered the student, according to their role. Evalent staff with an administrator role can open a school workspace for support and platform operation. Assessors who receive a report by email use a signed link that expires after 14 days. Data is never sold, never used for advertising, and never shared with third parties except the providers listed below.

Anthropic

Language model that writes evaluation narratives, scores writing, summarises specialist documents and generates reports. Receives assessment responses and, in some cases, student first names and uploaded documents. Anthropic’s commercial terms include a data processing addendum, and API data is not used to train its models.

OpenAI

Transcribes voice responses and produces the audio for listen features. Receives voice recordings and text generated from school records. OpenAI does not train its models on API data by default.

Supabase

Database and file storage for all school and student records.

Vercel

Application hosting and scheduled jobs.

Resend

Sends transactional email such as invitations, password resets and assessor reports, and receives replies to our messages.

Paddle

Billing and payments, as Merchant of Record. Receives billing contact details only.

Hosting

The Evalent application runs on Vercel, which runs on AWS. Physical security, redundancy and monitoring of the underlying data centres are maintained by those providers.

Database

Student and school records are stored in Supabase (PostgreSQL on AWS). Supabase encrypts stored data with AES-256 and publishes a SOC 2 Type II report.

Where data is processed

Our production database is hosted in the EU (Ireland). Our application servers and our AI providers (Anthropic and OpenAI) process requests in their own regions, which may be outside the EU and outside the UAE. Where personal data leaves the UK or EEA, the providers’ data processing terms include standard contractual clauses. If your school needs a specific data residency arrangement, please contact us before you onboard.

Backups

Supabase takes automated, encrypted database backups. Backup frequency and retention follow our Supabase plan.

In transit

All traffic to Evalent is encrypted with TLS. HTTP is redirected to HTTPS, and our sites send an HTTP Strict Transport Security header with a two year lifetime, so browsers will not connect over plain HTTP.

At rest

Database storage is encrypted with AES-256, managed by Supabase and AWS.

Passwords

Passwords are hashed with bcrypt before storage and are never stored or logged in plain text.

Password rules

Passwords chosen by school users must be at least 12 characters.

Schools own their passwords

A school user chooses and changes their own password. A school administrator can send a colleague an invitation or a reset email, but cannot type a password for them. Evalent staff do the same. A password typed by Evalent is a last resort when email cannot be used, is recorded in the audit log, and must be changed at the next sign-in.

Invitation and reset links

Links are single use and are stored only as a one-way hash, so a copy of our database cannot be used to take over an account. Reset links expire after 1 hour. Invitations expire after 7 days. Starting a new reset or invitation cancels the previous link.

No account guessing

The forgotten password page gives the same answer whether or not an account exists for the email address.

Sessions

Sign-in sessions are signed tokens that expire after 8 hours and are kept in cookies that JavaScript cannot read. Changing a password or deactivating an account ends existing sessions within a minute.

Safe redirects after sign-in

After sign-in, we only send people to a page on our own site. Links that try to send someone to another website are ignored.

Partner portal

Partners sign in to a separate portal with its own signed session cookie, which expires after 8 hours. A partner session does not give access to student data.

School data separation

On staff routes, the school is taken from the signed-in session, not from anything the browser sends. Student reports, student records, Course Selector data, grade settings and Evalent Intelligence records are checked against the signed-in school before they are returned or changed. Survey and invitation responses are tied to the invitation they were sent under. Evalent Intelligence applies additional ownership checks between people and schools, and these have automated tests. We are extending automated cross-school testing to every product.

Roles

Access depends on role. School administrators, school viewers and assessors have different rights. Evalent administrator and finance areas are blocked for school accounts. Finance accounts are limited to the finance area and do not see student evidence.

Staff permissions inside a school

Inside a school, an administrator decides what each colleague can do in Admissions, and which products each person can open. These permissions are enforced on the server, not just hidden in the screen.

Links for students, parents and teachers

Links we send to students, parents and teachers for voice checks, surveys, evidence uploads and spreadsheet uploads use long random codes. Each is tied to one school and, where relevant, one person. They cannot be used to reach other records.

Assessor report links

Assessors who receive a report by email use a signed link that expires after 14 days and opens only that student’s report.

Scheduled jobs

Every scheduled job requires a secret credential and refuses to run if that secret is not set.

Internal endpoints

Internal scoring and processing endpoints require their own secret credential. Maintenance and test endpoints are switched off in production unless deliberately enabled.

Payment events

Billing events from Paddle are accepted only with a valid signature, within a five minute window, and each event is processed once. Billing events are matched to a checkout record our server created, or to the school’s existing subscription, rather than trusting a school identifier sent by the browser.

Other webhooks

Events from our email and assessment providers are checked with a shared secret or signature. A daily check tells us if any of these secrets is missing.

Uploads

Uploads have type and size limits. Voice recordings are limited to 25 MB. Specialist documents are limited to 8 MB. School reports and evidence files are limited to 4 MB each. School logos must be PNG, JPEG or WebP images and under 500 KB. SVG files are refused because they can carry scripts.

Input validation

API requests are validated on the server. We use schema validation on registration and several other routes and are extending it to every route.

Security headers

Our sites send HTTP Strict Transport Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and a Content Security Policy that limits which sources can load scripts, frames and connections.

Secrets

API keys and database credentials are held in Vercel’s encrypted environment settings and are not committed to source control. The key that gives full database access is never sent to a browser.

Generated audio

Audio generated for school staff is sent with instructions that stop the browser from caching it, and is not stored with school evidence.

Server-side access only

All application access to the database goes through our servers.

Evalent Intelligence tables

Every Evalent Intelligence table has row-level security and is reachable only by our server role. Database functions use a fixed search path, and views apply the permissions of the person asking. We confirmed this by reviewing the live database catalogue on 23 July 2026.

Permission drift check

A function checks every day that no Evalent Intelligence function has been left open to the public or to signed-in browser users. A change that reopens one is reported to our team the next morning.

Audit log

Key actions are recorded with the person who did it and the time. These include student registration, school administration, and password invitations and resets. Evalent administrators can review the log.

Daily security report

Every day an automated job checks that critical secrets are present and that database permissions have not drifted. It emails a report to our team that separates urgent actions from other actions. It reports only. People decide and apply fixes.

Usage and cost monitoring

We record the AI model calls made for each school, which helps us spot abnormal activity.

How long we keep data

We keep school accounts and student records while a school subscribes, and for 12 months after cancellation. After that they are deleted. Trial schools that do not subscribe are covered by the trial retention terms in our Privacy Policy.

Deleting earlier

Schools can ask us to delete a student, a set of records or the whole school account at any time by emailing hello@evalent.io. Deletion is carried out by our team. We do not yet offer a self-service deletion and export tool.

Short-lived data

Voice recordings are deleted from our storage as soon as they have been processed. Original specialist documents are erased once the summary is produced. Generated audio held for faster playback is kept for about 24 hours.

Data protection roles

Schools are data controllers. Evalent is the data processor. Our Privacy Policy sets out the legal detail. We are working towards a standard Data Processing Agreement for every school customer. Schools with GDPR or UAE data protection obligations should contact us to discuss their requirements.

Provider certifications

Our infrastructure providers publish their own certifications, including AWS (ISO 27001, SOC 2), Supabase (SOC 2 Type II) and Vercel (SOC 2 Type II, ISO 27001). These cover the infrastructure layer, not the Evalent application.

Penetration testing

An independent penetration test of the Evalent application has not yet been done. We plan to commission one. Schools with specific requirements should contact us.

ISO 27001 and SOC 2

Evalent does not currently hold ISO 27001 or SOC 2 certification at the application level.