Security

This page summarises how Scholarova Ltd protects the Service and personal data. It complements the Privacy Policy and data processing agreement. We describe controls we rely on today.

Questions: Admin@scholarova.com

1. Encryption in transit

Traffic between browsers and Scholarova is served over HTTPS (TLS). Connections from our application to our managed database and to third-party services use TLS where those providers support it.

2. Encryption at rest

Organisation and user personal data is stored in a managed database in London, United Kingdom, as described on /subprocessors. We rely on our database provider's encryption at rest for stored data and backups, together with access controls and secure handling of service credentials.

2.1 Passwords and sign-in

Email-and-password accounts use one-way password hashing; passwords are not stored in plaintext. You can also use Google Sign-In and optional Google Classroom where your organisation enables them. Sign-in and session data are transmitted over HTTPS and protected by application and infrastructure access controls.

3. Where the Service runs

Application logic runs on serverless compute in the United Kingdom. Static assets may be served from a global content delivery network; personal data processing for authenticated product features runs in the UK unless a specific integration states otherwise.

Primary database hosting is in London, United Kingdom. Sub-processor names and locations are on /subprocessors.

4. AI inference

Student- and teacher-facing AI features send prompts for inference through our configured AI routing when AI is enabled for your organisation. For those tasks we use zero data retention (ZDR), policies that do not use prompts or outputs to train machine-learning or foundation models, and EU inference routing (our inference provider does not offer UK-only routing). Details, including children's AI defaults and assessment integrity, are in the Privacy Policy (AI-assisted features) and related sections — not duplicated here.

Organisations control whether AI features are enabled in product settings.

5. Access control and least privilege

Fine-grained least privilege is enforced in the application by role and organisation membership: signed-in users only reach data their role and organisation allow. Scholarova platform administration is limited to authorised Scholarova staff. Organisation administrators manage their own scopes in the product.

6. Data isolation and environment security

Restricted production access: Direct access to production databases and live infrastructure is strictly limited to authorised administrative roles on a minimal-access basis for system maintenance and health.

Access safeguards: Administrative connections require Multi-Factor Authentication (MFA), encrypted TLS/SSL transport, and strict credential management.

Audit logging: Infrastructure and database sessions generate automated, immutable system logs to ensure full accountability and real-time operational oversight.

7. Logging and retention

We generate operational and security logs (for example authentication events) to run and protect the Service. How long we keep personal data and logs — including the 90-day retention for security and authentication logs — is defined in the Retention section of the Privacy Policy. That schedule is the authoritative source; we do not duplicate every period here.

8. Personal data breaches

If we become aware of a personal data breach affecting organisation data we process as a processor, notification to the organisation is as set out in section 5.1 of the data processing agreement. Where UK GDPR requires us to notify individuals or the ICO, we will do so in line with applicable law. Report suspected incidents to Admin@scholarova.com.

9. Your responsibilities

Use a strong unique password, keep devices updated, and do not share sign-in details. Organisations should manage staff access in the product and use the DPA and sub-processor list when completing due diligence.

10. Changes

We may update this page when our architecture or providers change. Material updates will be reflected in the effective date above.