Data Security | Why Evalent

Your school is the data controller

Under GDPR, the organisation that determines the purpose and means of processing personal data is the data controller. For student applicant data, that is your school, not Evalent. Evalent acts only as a data processor, processing data strictly on your school’s instructions. This means your school retains full ownership and control of all assessment data from day one.

Student data is never used to train language models

Assessment responses, including extended writing, are processed by Evalent only to generate the report for that specific student. Our language model providers, Anthropic and OpenAI, do not train their models on data sent through their business APIs, and Anthropic’s commercial terms include a data processing addendum. Student data is used for one purpose: producing the report your school requested.

UAE data protection law and GDPR-aligned

Evalent is operated by Evalent LLC TZE, a company registered in the Ras Al Khaimah Economic Zone (RAKEZ), UAE. We comply with both UK GDPR (as administered by the Information Commissioner’s Office) and EU GDPR. Where sub-processors operate outside the UK and EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the UK ICO and European Commission.

Retention and deletion

We keep school accounts and student records while your school subscribes and for 12 months after cancellation, then delete them. You can ask us to delete a student, a set of records or your whole account at any time by emailing hello@evalent.io, and our team carries it out. Voice recordings are deleted as soon as they are processed, and original specialist documents are erased once they have been summarised. Our Privacy Policy sets out the full retention terms.

Providers that process data

Evalent shares data only with the providers required to deliver the service: database hosting (Supabase), language models (Anthropic, and OpenAI for voice transcription and audio), transactional email (Resend), payments (Paddle, billing contact details only), and platform infrastructure (Vercel). Each processes data only under its own data processing terms. We do not sell personal data to any third party, and we do not use student data for advertising, profiling, or any purpose beyond delivering your school’s reports.

Secure infrastructure

All data is encrypted in transit (TLS 1.2+) and at rest. Access to assessment data is restricted to authenticated school users only. Assessors receive a secure link that expires after 14 days to view the specific report they need, with no access to any other student data. Sessions end after 8 hours, and schools choose and reset their own passwords.

Read the full detail

Our Data Security page sets out what we hold, who can see it, every provider that processes it, and the controls that protect it. The legal detail is in our Privacy Policy and Terms of Service.