Security and data protection
How Edument OS protects school data — honest infrastructure notes for procurement, IT, and DPOs. We do not publish fake compliance badges or customer logos on this site.
Cloudflare infrastructure
Edument OS runs on Cloudflare’s global edge network — Workers, Durable Objects, and related platform services for application logic, tenant isolation, and low-latency access for international schools.
Each school operates in an isolated tenant environment. Staff access is role-based; super-admin and school-admin boundaries are enforced in the product.
Encryption
Traffic to Edument OS is served over HTTPS (TLS). Data at rest uses platform-level encryption provided by our cloud infrastructure. Secrets and integration tokens are stored using environment-scoped secret management — not in client-side code or public repositories.
Data residency
Edument OS is designed for international schools with GDPR, UK GDPR, PDPL, DPDP, and similar expectations. We do not claim automatic compliance with every jurisdiction — your counsel should map our controls to your obligations.
Contact hello@edument.app during procurement for current hosting and subprocessors documentation.
DPA and subprocessors
We provide a Data Processing Agreement (DPA) for institutional customers on request. Subprocessors include infrastructure and payment providers necessary to operate the service — notably Cloudflare (hosting/platform) and Paddle (subscription merchant of record).
Meta (WhatsApp Business), Google (Classroom / Workspace SSO), and Mailflow (AzAd) are connected only when your school enables those integrations.
Backups and restore
Professional and Enterprise include scheduled tenant backups with restore workflows and retention controls. Starter includes basic export paths suitable for smaller single-campus schools.
Schools should still maintain their own export discipline for critical academic records — backups are part of resilience, not a substitute for local governance policy.
What we do not claim
We do not display SOC 2, ISO 27001, or similar certification badges we have not earned. We do not publish proprietary customer testimonials or school logos on this marketing site.
Proof is in the product: isolated tenants, documented subprocessors, WhatsApp template discipline, and honest plan limits — evaluate against your checklist and ask us directly.
