INSTITUTIONAL COMPLIANCE & SECURITY
Data Governance & Security Protocols
Institutional protocols covering educational data classification, retention lifecycles, QuestAI Core provider policies, cryptographic storage, and School Data Processing Agreements (DPA).
Version 3.2 · September 2026
Informed by ISO 27001 & SOC 2 Principles (Not Certified)
QuestAI Core Fail-Closed Gateway
School DPA Standards
1. Educational Data Classification Matrix
Data within QuestAI Study is classified into four operational tiers with rigorous server-side boundary enforcement:
| Classification Tier | Data Included | Access & Cryptographic Controls | Export & Purge Lifecycle |
|---|---|---|---|
| Tier 1 · Official Records | Official assessment grades, teacher rubrics, formal school attendance, enrolled cohort rosters | Strict Role-Based Access Control (School Admin & assigned Teacher only); immutable against AI tool modification | Retained throughout school enrolment; archived in accordance with school and jurisdictional recordkeeping guidelines |
| Tier 2 · Coursework & Evidence | Draft essays, DOCX revisions, math scaffolds, teacher task sheets, personal study plans | Private to student + accessible to teachers upon milestone submission; AES-256 encrypted at rest | Exportable to DOCX/JSON at any time; permanently purged within 14 business days of account departure |
| Tier 3 · Formative Learning Data | Flashcard recall intervals, formative question check attempts, Feynman clarity evaluations | Private to student profile; drives adaptive timetable sprint pacing and spaced revision cues | Maintained for active academic year; reset on cohort rollover or student request |
| Tier 4 · Operational Telemetry | System error telemetry, AI request latency metrics, security audit trails | Platform engineering & security team; sanitized of personal student content | Automated rolling 30-day retention and purge schedule |
2. QuestAI Core Gateway & Provider Policy Controls
All AI capabilities within QuestAI Study are mediated through QuestAI Core, an internal AI gateway and policy router. Upstream model integrations are governed by an automated, code-enforced provider policy framework:
| Policy Field | Enforced Standard | Operational Purpose |
|---|---|---|
approvedForStudentData |
true (strictly required) |
Guarantees that the upstream provider has contractually agreed to student privacy and non-training terms. |
promptTrainingAllowed |
false (strictly enforced) |
Prohibits customer prompts, context documents, or AI outputs from being used to train foundational AI models or improve provider products. |
retentionClass |
commercial_abuse_only |
Restricts upstream log retention to configured project settings (e.g. 7 to 55 days) strictly for abuse detection, safety, and security debugging. |
regionClass |
au_us_enterprise |
Restricts routing to vetted, enterprise-grade cloud data centres located in Australia and the United States. |
fallbackPriority |
Ordered 1..N with Fail-Closed | Executes seamless failover between approved paid Gemini projects; immediately fails closed if no compliant provider is reachable. |
Paid API Project Distinction: QuestAI operates exclusively against enterprise Google Cloud Gemini API paid billing projects in Google AI Studio. Prompts and responses are not used by Google to improve its products. This is entirely separate from consumer web subscriptions (such as Google AI Pro).
3. Lifecycle, Archival & Data Portability
Rolling Operational Purges
Transient session data, temporary system logs, and diagnostic telemetry are automatically purged on a 30-day rolling cycle via automated background tasks.
14-Day Permanent Purging
Upon conclusion of an institutional partnership or student deactivation request, student records and uploaded coursework are deleted immediately from active views and permanently purged from backup storage within 14 business days.
4. Cryptographic Storage & Security Alignment
Security controls informed by ISO 27001 and SOC 2 Trust Services Principles. QuestAI is not currently independently certified against these standards:
- SHA-256 Digest Verification: Every syllabus resource, task sheet, and evidence document generates an immutable SHA-256 hash upon upload to ensure tamper detection.
- Multi-Tenant Logical Isolation: Strict tenant segregation is enforced at the database layer (`WHERE school_id = $1`). Cross-school queries are strictly forbidden by server-side policy guards.
- Protected Storage: Coursework assets reside outside public web roots and are served exclusively via authenticated, permission-checked session endpoints.
- Encryption Standards: Data in transit is protected using modern TLS (TLS 1.2 / TLS 1.3); database tables and stored files utilize AES-256 encryption at rest.
5. Institutional School Data Processing Terms (DPA)
For educational institutions utilizing QuestAI Study under an Institutional Agreement:
- Controller vs Processor Roles: The subscribing School or Education Authority acts as the Data Controller with primary legal authority over student educational records. QuestAI acts solely as a Data Processor operating under the school's instructions.
- No Advertising Exploitation of Student Records: Student educational records, submissions, grades, and AI study queries are strictly protected and never sold, leased, or monetized for targeted/behavioral advertising.
- Security Incident Notification: In the event of a confirmed security incident impacting institutional data, QuestAI will provide initial incident notification within 72 hours where required, followed by investigation findings and remediation details as they become available.
- Audit Controls: School administrators maintain access to administrative event logs capturing key actions, member enrolments, and policy modifications within their school portal.