Security, privacy and data governance
Education data is sensitive. Edor.ai protects schools and students at the architecture, process and contract level.
Input guard
Detects inappropriate requests, personal data and jailbreak attempts; stricter in student mode.
System prompt
School policy, age band, subject context and Socratic rules injected into every call.
Output review
Responses classified for safety; suspicious content masked and flagged for admin review.
Audit & quotas
Every AI interaction logs module, model, usage and safety action; quotas per role / user.
Accounts & access
- Single sign-on entry, JWT with HttpOnly cookies, forced password change on first login
- Six roles with subject / class scoping
- Audit logs for all sensitive actions
- Optional IP and time-window restrictions
Data protection
- PII fields (phone, student ID, guardian contact, SEN notes) encrypted with AES-256
- API keys and integration credentials encrypted, last-4 display only
- Retention policy: conversations and AI logs purged after configured days
- TLS 1.2+ in transit; isolated database and file volumes per school
AI usage policy
- Student data is never used to train models; no-training API terms only
- System prompts forbid requesting or outputting student personal data
- Four-layer safety guard: input, system prompt, output review, audit & quotas
- Moderation flags reviewed by admins; strict mode available
School owns the data
- Full export of knowledge assets, resources, rubrics, curriculum and student records (JSON / CSV / original files)
- Switchable AI providers (OpenAI / Azure OpenAI / Anthropic / Poe / local Ollama)
- Assisted migration and deletion at contract end
- PDPO Data Protection Principles mapping document
Data ownership & portability
- The data always belongs to the school — whether deployed on-premises or in the cloud
- Admins can download everything in one click (/api/school/export/all), free and unlimited
- Schools are free to switch providers at any time; that is how confident we are in the service
- School custom domain supported (e.g. ai.yourschool.edu.hk) with school branding on the login page
- On-premises option: installed on the school's server or private cloud, data never leaves the school
The data always belongs to the school
Whether a school chooses on-premises or cloud deployment, all data belongs to the school and can be downloaded in full, free of charge, at any time. That is our confidence in the service: schools stay because the platform works, not because they are locked in.
The school owns the data
Lesson plans, resources, knowledge base, assessments, student records and school analytics — intellectual property and ownership rest with the school. Edor.ai is only the data processor.
Full export, free, any time
Administrators export everything in one click (one JSON per table, resources and knowledge base as Markdown, original files). No fee, no limit, no request needed.
Free to switch providers
Schools may leave with their data at any time, no reason required. At contract end we assist migration and provide a deletion certificate. AI providers can be switched at any time too.
Your own school domain
Connect the platform on the school's domain (e.g. ai.yourschool.edu.hk) with a single CNAME record; the login page shows the school crest and name.
ai.yourschool.edu.hk CNAME edor.aiTender technical requirements mapping (A1–A5)
How Edor.ai meets the Part 1 technical requirements typical of Hong Kong school AI platform tenders.
| Ref | Requirement | Edor.ai implementation |
|---|---|---|
| A(1) | Unified login & access management | Single entry, RBAC, audit logs, forced password change, session control |
| A(2) | Data security & privacy | PII encryption, TLS, retention, PDPO mapping, no-training terms |
| A(3) | School data governance & knowledge assets | Knowledge base + RAG, full export (free, any time, on-premises or cloud), school ownership, free to switch providers, custom domain |
| A(4) | LLM compliance & safety | Provider abstraction, switchable, quotas, AI audit logs |
| A(5) | AI ethics & content guard | Multi-layer guard, student mode, human review, Socratic tutor |
Privacy policy & terms summary
Edor.ai collects only what is needed to provide the service: staff and student account data supplied by the school, platform usage records and user inputs. Data is used solely to deliver and improve the service, ensure safety and fulfil the contract; it is never sold or used to train AI models. The school is the data user and Edor.ai the data processor acting on the school's instructions.
Contact-form data on this website is used only to respond to enquiries. The full privacy policy and terms of service are provided with the contract; enquiries: info@edor.ai。
Ready to bring AI into your classrooms?
Book a demo — we'll show it with your school's subjects and grades.