Committed to keeping student work safe
EdnasLearn handles the schoolwork of real students, so security isn't a feature, it's a requirement. Here is exactly what we do, in plain language.
Australian storage, with clear processing exceptions
Our application, database, and private file storage run in Sydney, where we store student submissions, marks, and feedback. Written marking and handwriting transcription send work to Anthropic's API, which may process it outside Australia. Email, analytics, and monitoring also use service providers listed in our privacy policy.
Encrypted everywhere
All traffic uses HTTPS (TLS), and data is encrypted at rest in the database and file storage. Uploaded worksheets and student essay files live in a private bucket: nothing is publicly accessible, and files are only served through short-lived signed links to the people allowed to see them.
Strict access boundaries
Every request is checked against who owns what. Teachers can only see their own classes and their students' work in those classes; students can only see their own submissions, and only the results their teacher has released. These checks run on the server for every page and API call.
AI that doesn't train on your students
Written marking and transcription use Anthropic's Claude API. Anthropic states that commercial API inputs and outputs are not used for model training by default; its retention rules and exceptions are linked in our privacy policy. Multiple-choice answers are scored in code. Teachers can review and override marks, and choose whether results are released automatically or after review.
We never see card details
Payments are handled entirely by Stripe, a certified PCI Service Provider Level 1. Card numbers are entered on Stripe's pages and never touch our servers.
Verified accounts and abuse protection
Every account requires email verification. Sign-ups, class joining, and AI endpoints are rate limited, and class access requires a join code from the teacher.
Monitoring with limited data
Sentry records technical errors with default personal-information collection, performance tracing, and session replay disabled. Langfuse traces omit marking inputs and outputs and transcription outputs. Teacher worksheet and rubric content, prompt versions, timings, token counts, and call metadata may be traced. These controls keep student answer content out of marking traces while helping us diagnose failures.
Minimal data, deletable on request
We collect what the product needs to work: a name, an email, and the schoolwork itself. No advertising trackers, no selling data, ever. You can request deletion of your account and data at any time.
An honest note on certifications
We are a small team and we don't currently hold formal certifications like ISO 27001 or SOC 2. Rather than imply otherwise with badges, we'd rather tell you plainly what we practise: the measures above, a bias toward collecting less data, and fixing security issues before feature work. If your school or centre needs specific security documentation, ask us.
Found a vulnerability?
If you believe you've found a security issue in EdnasLearn, we want to hear about it before anyone else does. Email admin@ednasai.com with the details. We read every report, we'll respond quickly, and we won't take action against good-faith research.
For what we collect, why, and the full list of providers that process it on our behalf, see the privacy policy.