AIVO Learning protects learner and family data with layered technical and organizational safeguards. This page describes what is in place today and what is still in progress. We label every statement honestly: nothing on this page is a certification unless we say so explicitly, and the Trust Center shows the live status of every assurance claim we make.
Safeguards in place today
- Encryption in transit. Connections to AIVO services use TLS, and insecure connections are redirected to secure ones.
- Encryption at rest for uploaded documents. Learner documents and support attachments are stored with AES-256 server-side encryption.
- Role-based, relationship-scoped access. Every application surface enforces authorization by role and by relationship: parents see their linked learners, teachers see assigned students, therapists see their caseload, and platform operators use purpose-limited support paths that are audited.
- Multi-factor authentication. AIVO supports time-based one-time-code MFA, with step-up verification required for sensitive administrative actions.
- Tamper-evident audit logs. Administrative and data-access events are recorded in hash-chained, append-only audit logs.
- Malware scanning for uploads. Uploaded documents are scanned before they can be processed or downloaded. If scanning is unavailable, uploads are held. They are never silently passed through.
- Backups with restore verification. Databases are backed up automatically, and restore jobs run on a schedule to verify that backups actually restore.
- Single sign-on for institutions. Districts can connect their existing identity provider, and district data stays district-controlled under district agreements.
In progress, stated plainly
- SOC 2. A SOC 2 Type II examination is in progress: the observation window is underway and the report is expected in Q4 2026. Until the report is issued, we do not describe AIVO as SOC 2 certified, audited, or compliant, and no completed SOC 2 report exists today.
- Independent penetration testing. An independent penetration test is planned. After it is complete, a summary will be available to schools and districts under NDA. Until then, we do not claim independent security testing.
AI provider safeguards
Model providers used for lesson generation are contractually prohibited from using learner data to train or improve their models. Lesson context sent to providers is pseudonymized and minimized. AIVO does not operate a proprietary foundation model in production. The current provider list, with data categories and regions, is in the subprocessor register.
Reporting a security issue
Report suspected vulnerabilities to [email protected]. We confirm receipt, keep you informed while we investigate, and prioritize fixes by severity. Please do not include learner personal information in reports.
Where to check current status
The Trust Center lists every assurance claim with its real evidence status: what is verified, what is contractual, and what is still underway. Questions about this page: [email protected].