Trust and student data
Built so your customers' security review has easy answers.
EdTech buyers ask about student data before they ask about features. These are the design facts behind every module we build, written so your team can repeat them to districts and institutions.
The short version
- Synthetic or de-identified data in the Build Sprint, Planning Sprint and AI Scorecard.
- Production student data stays in your cloud.
- Production access only as you grant it, revocable at any time.
- No training on your data.
- A person approves anything material.
- Every AI draft, action and approval is logged.
Student data
We build on synthetic or de-identified data, not production student data.
The safest data is data we don't hold. The Build Sprint, Planning Sprint and AI Scorecard, and the first production release, are designed so we do not need it.
How data is handled
- Sprint work runs on synthetic or de-identified data, not on production student records.
- Production student data stays in your cloud, under your access controls. It does not move to Datics systems.
- In production we work only through access you grant, and you can revoke it at any time. Code reaches your product as pull requests through your CI/CD.
- During a Sprint we work in your staging environment and repository, with accounts you issue and can revoke at any time.
- When a Sprint ends we delete any copies of your documents or test data we hold, and confirm it in writing.
- If a later phase genuinely needs data access, it happens under your agreements and your counsel decides how they apply.
AI controls in every module
- No training on your data or your customers' data.
- Approved model endpoints only, listed with region and retention. Your choice of model and hosting.
- In the Build Sprint, models run on endpoints in your cloud account by default. If you prefer, we run them on ours using synthetic data only; the data-flow sheet names which.
- An approval step before anything material is written, sent or changed.
- An audit log of what the AI saw, drafted and did, and who approved it.
- On or off per institution, with data settings your admins control.
- Where a module answers questions, answers cite their source, with a clean handoff to a person when the AI does not know.
Evaluation
Quality, safety and cost are measured before launch.
Every Sprint ends with evidence, not a demo alone.
What the Build Sprint Pack tests
- Quality evals on a test set your team reviews, so quality is a number before launch.
- Safety tests for cross-tenant access, prompt injection, personal-data leakage and refusals.
- A cost-to-serve estimate on two models, so the feature's margin is known before it ships.
- Institution isolation, tested: questions crafted to pull another institution's data return nothing.
Accessibility
- New screens are designed and tested against WCAG 2.1 AA: keyboard use, contrast, labels and captions.
- We can review existing flows against the ADA Title II web-accessibility rule and fix what we find, as an engineering review, not a certification.
Security reviews
Help with HECVAT, district questionnaires and DPAs.
We help you answer the parts of your customers' reviews that cover the features we build.
What you get
- A security overview and a data-flow sheet for each module, ready for your customers' reviews.
- Help answering the AI and data sections of HECVAT and district questionnaires for the features we build.
- Architecture and data-flow documentation for production releases, including the models used and a way to switch the feature off.
Who you are working with
- Datics AI is headquartered in Austin, Texas, where our CEO is based. Product Review calls run in US Central time.
- A named lead engineer and US-hours overlap on every engagement.
We work within your FERPA, COPPA, accessibility, security and institutional requirements. Compliance depends on the complete product, contracts, policies and operating environment; Datics does not present software engineering alone as legal certification.
See it on your own product.
Bring one product, workflow or AI feature. In 30 minutes we tell you which of the three ways to start fits, what it would cost to serve and what your customers' security review will ask.
Calls run in US Central time. No generic AI presentation: we discuss your product, users and production constraints.