Edusign
Compliance & security

AI and student data: the compliance guide for CISOs and DPOs

Edusign compliance team · 13 Mar 2026 · 7 min read

The essentials in 30 seconds

  • Our AI models are not trained on your data: they are pre-trained on public, generic datasets, unrelated to education or to your institution.
  • Your data is hosted in Europe by default: AWS Europe, with backup at OVHcloud.
  • No critical decision (grading, sanctions, attendance validation) is made automatically: a human always has the final say.
  • Every AI feature can be switched on independently, with granular access rights and fine-grained consent management.
  • The 7-point checklist and the FAQ below are written to be reused as-is in your security questionnaires and tender responses.

You are a CISO, a DPO, a registrar or the head of a training organisation, an apprenticeship centre or a school. A vendor announces "a new AI feature" and the same questions come straight back: where does my learners' data go, who processes it, and what will I put in the next security questionnaire?

This document answers them in the order they arise. It is both an official Edusign commitment and a documentary basis for your audits, your public tender files and your impact assessments. Last updated: August 2026.

Our principle: AI assists, it does not decide

At Edusign, artificial intelligence never replaces human judgement: it assists it, with rigour, transparency and ethics. In an educational context, trust is an absolute requirement: trust in the technology, in data management, and in respect for academic values.

That principle breaks down into three commitments, detailed below: the confidentiality of your data, the sovereignty of its hosting, and an ethical guarantee on the processing produced.

Confidentiality: what our models see of your data

A DPO's first question is always the same: is my data used to train a model? Here is the answer, item by item.

Models pre-trained on public data

Our models are pre-trained on public, generic datasets, unrelated to education or to your specific environments. Your learner lists, attendance sheets and assessments are not part of them.

Siloed data, never pooled

Your institution's data is siloed, never pooled with that of other customers, and remains your intellectual property. No cross-learning from one institution to another.

Data minimisation as the default setting

Our guiding principle is data minimisation. For our core AI models, no history or metadata is transmitted for fine-tuning.

Granular control on your side

All AI features can be activated independently, with granular access rights and fine-grained consent management. You can open AI up to one department and not another, or not switch it on at all.

Sovereignty: where your data lives

By default, everything stays in Europe. Some advanced features call on partners located outside the EU: those flows are governed, ephemeral and encrypted. The table below sums up the situation item by item.

ItemWhere the data lives, and under which safeguards
Primary hostingAWS Europe. 100% European by default.
BackupOVHcloud, a European host.
Advanced AI featuresPartners outside the EU (e.g. Anthropic), governed by the Standard Contractual Clauses: ephemeral and encrypted transmission, no permanent storage outside the EU.

The European Commission's Standard Contractual Clauses (SCCs) govern all transfers, with technical safeguards preventing the reuse or permanent storage of the data transmitted.

Ethical guarantee: human oversight and explainability

Processing can be GDPR-compliant and still be unfair. That is why we also govern what the AI produces, not just where the data travels.

  • Human oversight. No critical decision (grading, sanctions, attendance validation) is made automatically. Humans remain the final arbiters.
  • Algorithmic explainability. Our AI systems are designed according to the principles of algorithmic explainability (XAI): each function can be justified and documented.
  • Bias correction. Our algorithms are regularly tested to identify and correct biases that could produce discriminatory effects.
  • Internal audits. All AI modules are internally audited to ensure their compliance and reliability.

A security questionnaire or a tender to answer?

Our compliance team will send you the complete dossier: technical, legal, cybersecurity, accessibility.

Request the dossier

The AI compliance checklist: 7 checkpoints

Reuse these seven lines as-is in your vendor assessment grid: they cover the essentials a CISO or a DPO should verify before opening an AI feature to learners.

CheckpointEdusign's answer
1. Is data used to train the models?Our guiding principle is data minimisation. Our core models are not trained on your data. Specific conditions for advanced features are detailed in our DPA and subject to your agreement.
2. Is data hosted within the European Union?Yes, by default within the EU (AWS Europe, backup at OVHcloud), unless an optional external module is explicitly activated.
3. Are transfers outside the EU legally governed?Yes. All transfers are covered by the European Commission's Standard Contractual Clauses.
4. Do you keep control over activations?Yes. You retain control over the activation of key AI features from your interface.
5. Is human oversight enforced?Yes, for all high-impact decisions.
6. Are technical and ethical audits available?Yes, upon contractual request.
7. Are portability and reversibility guaranteed?Yes. Complete data export is possible at any time.

The documents to ask for before you sign

A commitment you cannot verify is worthless. Here is what you can require from us, and what we provide:

  • The DPA (data processing agreement), which governs the 30-day technical retention and the conditions attached to advanced features.
  • The complete public tender dossier: technical, legal, cybersecurity and accessibility sections.
  • The exact locations and types of processing, on simple request to dpo@edusign.fr.
  • Our security commitments and certifications, published on the Security page.

What this changes for your institution

Poorly governed AI exposes an institution to sanctions and to a loss of institutional trust. Governed AI does the opposite: it saves you administrative time without adding a single line of risk to your next audit.

Trusting Edusign means choosing a technology partner that places compliance, ethics and transparency on the same level as innovation.

Going further: security and certifications, privacy policy, or talk to our compliance team.

Your questions, our answers

The main risk is non-compliance with GDPR, particularly in the case of implicit model training on sensitive personal data. This exposes the institution to sanctions from data protection authorities and a loss of institutional trust.
All communications are made via secure APIs with strong authentication, TLS encryption, activity monitoring, and rapid key expiration. No personal identifier is transmitted in plain text.
Yes. This temporary retention is solely for technical monitoring and abuse or error detection. It is governed by our DPA and entirely separate from any algorithmic or marketing use.
Yes. Simply send us an email at dpo@edusign.fr; we will provide you with the complete details.
Yes. A complete dossier (technical, legal, cybersecurity, accessibility) is available upon request.

A question about AI and your learners' data?

Talk to our compliance teamSee the Security page