Security by Design

EDUMOVIA runs on managed, reputable cloud infrastructure. Application data is stored in the cloud rather than on local machines, and access to the underlying infrastructure is restricted to authorised operations only.

Specific data-residency or region requirements can be discussed as part of an enterprise arrangement. We do not publish infrastructure details that could weaken security.

Traffic between your browser and EDUMOVIA is encrypted in transit using industry-standard TLS (HTTPS). Data at rest is protected by the storage-level encryption provided by our cloud infrastructure.

We continually align transport security with current best practice, including HTTP-to-HTTPS redirection and strict transport security headers.

EDUMOVIA is multi-tenant by design: each organisation's students, partners, documents and communications are kept logically isolated from every other organisation. One customer cannot see or reach another customer's data.

Isolation is enforced at the data-access layer so that every request is scoped to the organisation that owns the record.

Access inside an organisation is governed by roles, so team members see only what their role permits. Administrative capabilities are separated from day-to-day operational access.

We follow a least-privilege approach: accounts and integrations are granted the minimum access needed to do their job.

Accounts are protected by email-and-password authentication with securely hashed credentials. Passwords are never stored in plain text.

Single sign-on (SSO) and multi-factor authentication (MFA) are available as part of enterprise onboarding on request; broader self-service availability is on our roadmap.

Application data is backed up through our managed cloud infrastructure to protect against data loss. Formal recovery objectives (RPO/RTO) are defined together with enterprise customers as part of their agreement.

We do not publish specific uptime or availability figures that we cannot yet formally guarantee.

We maintain internal processes to detect, investigate and respond to security events. Where an incident affects a customer's data, we will notify the affected organisation in line with applicable obligations.

A formally published incident-response and breach-notification policy is being finalised as part of our legal documentation.

Your data is retained for as long as your account is active. On termination, or on a verified deletion request, data is removed in line with our contractual and legal obligations.

Retention periods and deletion procedures are described in our Privacy Notice and Data Processing Addendum (version 1.0, currently in effect).

EDUMOVIA relies on a limited set of infrastructure and service providers to operate the platform. The current list of subprocessors is maintained in our Subprocessors document within the Trust & Legal section.

We assess providers for their security posture before relying on them for customer data.

If you believe you have found a security issue, please contact us at [email protected] with the details. We take all reports seriously and will investigate promptly.

We do not currently claim formal external certifications (such as SOC 2 or ISO 27001). Any certification we obtain in future will be stated explicitly here rather than implied.