Four things to know
Your school owns its data
Your school decides what is recorded and who sees it. We process it on your school's instructions.
Encrypted, and controlled by role
Data is encrypted when it is stored and when it is sent. Access in the platform is controlled by role, with permissions your school sets.
Certified
We hold our own ISO 27001 certification, and we are hosted on AWS infrastructure that is ISO 27001-certified.
An agreement for every school
A data processing agreement is available for every school, before you sign anything else.
Your school decides. We process.
For your students' and staff records, your school is the data controller and iScuela is the processor. We handle that data on your school's instructions, as set out in the data processing agreement.
For our own account, billing and support records, we are the controller.
Hosting and data residency
- Hosting: iScuela is hosted on Amazon Web Services.
- Where data is held: UK data residency. For schools in India, data is held on Amazon Web Services servers in India.
- Stored: data is encrypted at rest.
- In transit: data is encrypted in transit.
Certification status
- ISO 27001, iScuela: certified. We hold our own ISO 27001 certification.
- ISO 27001, AWS: certified. Our infrastructure provider, AWS, holds its own certification as well.
Data processing agreement
A data processing agreement is available for every school. Ask for it at any point in a procurement process, before signing anything else.
Third parties that process your data
We publish this list rather than supplying it on request, and we will tell you before it changes.
| Third party | Purpose |
|---|---|
| Amazon Web Services | Hosting, databases and file storage |
| Google (Gemini) | Language processing for Ask Me Anything, quiz generation and timetable generation |
| Google (Firebase) | Push notifications to the apps, app analytics and crash reports |
| Razorpay | Online fee payments in the parent app¹ |
| Zoho | Support chat and screen sharing (Concierge) |
¹ Razorpay acts as an independent controller for the payment details it handles.
In place today
What is in place today. We list nothing that is only planned.
- Our own ISO 27001 certification.
- Hosted on ISO 27001-certified AWS infrastructure.
- Data encrypted at rest and in transit.
- Data for schools in India held in India.
- School data never used to train AI models.
- A data processing agreement for every school.
- Access in the platform controlled by role, with permissions your school sets.
- Ask Me Anything answers only within the asker's own permissions.
Access by role
- By role: access in the iScuela platform is controlled by role. Your school creates the roles and grants the permissions. A permission that depends on another is granted with it, so a role cannot be left half-working.
- Sign-in: everyone signs in with their own login, by password or a one-time code. A person who works in more than one school, or holds more than one role, chooses which one at sign-in.
Ask Me Anything, the AI Tutor and children's data
- Ask Me Anything is for staff: it answers inside the permissions of the person asking and changes nothing in your records.
- The AI Tutor is for students: the tutor is built to work towards understanding rather than to produce finished work.
Schools in India: the DPDP Act
- Your school is the Data Fiduciary: under the Digital Personal Data Protection Act, 2023, your school decides why and how its students', families' and staff's data is used. iScuela is your school's Data Processor and handles that data only on your school's instructions.
- Children's data: everyone under 18 is a child under the Act. Your school obtains a parent's consent where the Act requires it; iScuela records and uses children's data only for your school's purposes, and never for advertising.
- Where your data is held: in India, on Amazon Web Services servers there.
- Families' rights: a parent who wants to see, correct or erase their child's data asks the school, and we help the school answer. Some records a school must keep by law.
FAQs
Is iScuela GDPR compliant?
We do not use that phrase; no supplier can promise it on a school's behalf. A data processing agreement is available for every school, and our data protection posture is set out in full on this page.
Is iScuela ISO 27001 certified?
Yes. We hold our own ISO 27001 certification. iScuela is also hosted on AWS, whose infrastructure is separately ISO 27001-certified.
Is our data encrypted?
Yes, both when it is stored and when it is sent.
We are a school in India. Where is our data held?
In India, on Amazon Web Services servers there.
Is our data used to train AI models?
No. Your school's data is not used to train any AI model.
What happens to our data when our contract ends?
We export your school's data and give it to you.
Who owns our data?
Your school does. We process it on your school's instructions, as set out in the data processing agreement.
Who is the data controller?
Your school, for your students' and staff records. iScuela is the processor and handles that data on your school's instructions, as set out in the data processing agreement.
Can staff sign in with Google or Microsoft?
Not today. Staff sign in with their own iScuela login, by password or a one-time code.