Security

Security, privacy and data governance

Education data is sensitive. Edor.ai protects schools and students at the architecture, process and contract level.

01

Input guard

Detects inappropriate requests, personal data and jailbreak attempts; stricter in student mode.

02

System prompt

School policy, age band, subject context and Socratic rules injected into every call.

03

Output review

Responses classified for safety; suspicious content masked and flagged for admin review.

04

Audit & quotas

Every AI interaction logs module, model, usage and safety action; quotas per role / user.

Accounts & access

  • Single sign-on entry, JWT with HttpOnly cookies, forced password change on first login
  • Six roles with subject / class scoping
  • Audit logs for all sensitive actions
  • Optional IP and time-window restrictions

Data protection

  • PII fields (phone, student ID, guardian contact, SEN notes) encrypted with AES-256
  • API keys and integration credentials encrypted, last-4 display only
  • Retention policy: conversations and AI logs purged after configured days
  • TLS 1.2+ in transit; isolated database and file volumes per school

AI usage policy

  • Student data is never used to train models; no-training API terms only
  • System prompts forbid requesting or outputting student personal data
  • Four-layer safety guard: input, system prompt, output review, audit & quotas
  • Moderation flags reviewed by admins; strict mode available

School owns the data

  • Full export of knowledge assets, resources, rubrics, curriculum and student records (JSON / CSV / original files)
  • Switchable AI providers (OpenAI / Azure OpenAI / Anthropic / Poe / local Ollama)
  • Assisted migration and deletion at contract end
  • PDPO Data Protection Principles mapping document

Data ownership & portability

  • The data always belongs to the school — whether deployed on-premises or in the cloud
  • Admins can download everything in one click (/api/school/export/all), free and unlimited
  • Schools are free to switch providers at any time; that is how confident we are in the service
  • School custom domain supported (e.g. ai.yourschool.edu.hk) with school branding on the login page
  • On-premises option: installed on the school's server or private cloud, data never leaves the school
Our promise

The data always belongs to the school

Whether a school chooses on-premises or cloud deployment, all data belongs to the school and can be downloaded in full, free of charge, at any time. That is our confidence in the service: schools stay because the platform works, not because they are locked in.

The school owns the data

Lesson plans, resources, knowledge base, assessments, student records and school analytics — intellectual property and ownership rest with the school. Edor.ai is only the data processor.

Full export, free, any time

Administrators export everything in one click (one JSON per table, resources and knowledge base as Markdown, original files). No fee, no limit, no request needed.

Free to switch providers

Schools may leave with their data at any time, no reason required. At contract end we assist migration and provide a deletion certificate. AI providers can be switched at any time too.

Your own school domain

Connect the platform on the school's domain (e.g. ai.yourschool.edu.hk) with a single CNAME record; the login page shows the school crest and name.

On-premises or cloud — the school decides ai.yourschool.edu.hk CNAME edor.ai

Tender technical requirements mapping (A1–A5)

How Edor.ai meets the Part 1 technical requirements typical of Hong Kong school AI platform tenders.

RefRequirementEdor.ai implementation
A(1)Unified login & access managementSingle entry, RBAC, audit logs, forced password change, session control
A(2)Data security & privacyPII encryption, TLS, retention, PDPO mapping, no-training terms
A(3)School data governance & knowledge assetsKnowledge base + RAG, full export (free, any time, on-premises or cloud), school ownership, free to switch providers, custom domain
A(4)LLM compliance & safetyProvider abstraction, switchable, quotas, AI audit logs
A(5)AI ethics & content guardMulti-layer guard, student mode, human review, Socratic tutor

Privacy policy & terms summary

Edor.ai collects only what is needed to provide the service: staff and student account data supplied by the school, platform usage records and user inputs. Data is used solely to deliver and improve the service, ensure safety and fulfil the contract; it is never sold or used to train AI models. The school is the data user and Edor.ai the data processor acting on the school's instructions.

Contact-form data on this website is used only to respond to enquiries. The full privacy policy and terms of service are provided with the contract; enquiries: info@edor.ai

Ready to bring AI into your classrooms?

Book a demo — we'll show it with your school's subjects and grades.