Skip to content

Trust

Security & data protection

EduCRM holds student records, family contacts and identity documents. This page says where that data is stored, who can reach it, and which third parties are involved.

Start free

Last updated:

Data region

europe-west1 (EU)

In transit

TLS 1.2 or higher

At rest

Encrypted in Google Cloud

Tenant isolation

Per-workspace, no cross-tenant reads

Data residency

  • Primary region: europe-west1, using Firebase Cloud Functions and Firestore.
  • Storing data in the EU aligns with GDPR expectations for EU customers. That is a fact about where data lives, not a legal opinion about your own compliance.

Encryption

  • All data in transit is protected with TLS 1.2 or higher.
  • Data at rest is stored in Google Cloud, encrypted by the platform.

Access controls

  • Per-workspace isolation. No cross-tenant reads.
  • Role-based permissions: owner, admin, counsellor and viewer.
  • An immutable audit log of access and admin events, written server-side and not editable afterwards.

AI data handling

  • Anthropic (Claude) processes inputs as a sub-processor under our data processing agreement. Customer data is not used to train models.
  • AI is limited to two things: turning spoken notes into tasks, and proposing column mappings on import. Both are shown to you for confirmation, and nothing is saved or sent automatically.
  • Usage and spend are visible to workspace admins under Settings → AI Usage.

Sub-processors

Anthropic · Google Cloud · Vercel · Stripe · Resend

Each is bound by its own data processing agreement. A current list, and our own DPA, are available on request from privacy@educrmapp.com.

Certifications

EduCRM does not hold an independently audited certification such as ISO 27001 or SOC 2. The controls on this page are facts about how the service is built, not a certified standard. If your organisation requires a certification, contact privacy@educrmapp.com and we will tell you where things stand.

Data Processing Agreement

Available on request: privacy@educrmapp.com.

How personal data is collected, used and retained is set out in the privacy policy, and the cookies this website uses are listed in the cookie policy.

Frequently asked questions

Where is EduCRM data stored?

In Google Cloud's europe-west1 region, using Firestore and Cloud Functions. That aligns with GDPR expectations for EU customers.

Is EduCRM data encrypted?

Yes. Data in transit uses TLS 1.2 or higher, and data at rest is encrypted in Google Cloud.

Who are EduCRM's sub-processors?

Anthropic, Google Cloud, Vercel, Stripe and Resend. A current list and a Data Processing Agreement are available on request from privacy@educrmapp.com.

Does EduCRM train AI models on customer data?

No. Anthropic processes inputs as a sub-processor under a data processing agreement and does not train on customer data. AI is limited to voice task capture and import mapping, and both need your confirmation.

Can access be restricted per team member?

Yes. Roles are owner, admin, counsellor and viewer, and each workspace is isolated with no cross-tenant reads. Access and admin events go to an immutable audit log.

Evaluating EduCRM for your consultancy?

The CRM buyer's guide has a security checklist you can put to any vendor, including this one.