Security and privacy
Built for classrooms that trust us with their data.
Schools sign data agreements with us, so we treat student data as regulated from the first line of code. Here is what that means in practice.
Your data
- Stored close to home. Our database is in India (Mumbai); board files and recordings are kept in Cloudflare storage in the Asia-Pacific region.
- No student accounts needed. Students join live sessions as guests with a display name; we don’t ask for their email.
- Predictable retention. Recordings and replays expire on a schedule your plan sets, and owners can delete them at any time. Deleted accounts are purged after a 30-day grace period.
- No advertising, no selling. We don’t sell data or use it for advertising, and our AI provider doesn’t train on your content.
- Private means private. Private Layer notes and unrevealed objects are kept in a separate server room and never sent to anyone but the owner: not over the network, not in search, not in AI answers.
How it’s protected
- Permissions on every request. One policy decides who may do what, checked on every API call and every live message, and enforced again by row-level security in the database.
- Encrypted in transit and at rest. HTTPS everywhere with HSTS; storage and database encryption at rest.
- Strong sign-in. Breached-password checks, rate limits, optional two-factor authentication, and an email to you for every security change.
- Tested continuously. Every change runs automated security scans (static analysis, dependency and secret scanning) and an authorization test for every action and role. External penetration tests run before school contracts.
- Audited. Security-relevant actions are written to an append-only audit log. Logs contain IDs, never board content or chat text.
Report a vulnerability
If you believe you’ve found a security issue, email security@inkwis.com with the details. Please don’t access other people’s data or disrupt the service while testing. We reply within 2 working days and keep you informed until it’s fixed.
Schools and institutes can request our data processing agreement and security documentation at hello@inkwis.com. See also our privacy policy and subprocessors.