Trust Center
Security & Privacy FAQ
Straight answers to the questions institutions, security reviewers, and parents ask most about NotAI's security, privacy, and compliance posture.
Where is my data stored?
NotAI is hosted on Microsoft Azure. Primary service data is stored and processed in the region you choose at signup (US or EU) and is not moved between regions. Limited ancillary data - billing and transactional-email metadata - is processed in the United States, as described in our privacy policy.
Do you use cookies or trackers?
No. The NotAI marketing site and this trust center set zero cookies and load zero third-party scripts: no analytics, no advertising pixels, and no tracking of any kind. There is no cookie banner because there is nothing to consent to.
What student data does NotAI collect?
NotAI analyzes behavioral signals about how work is produced. The Text Monitor observes typing patterns, pauses, and corrections while text is being composed, and the NotAI Pixel detects signs of AI agents and automated browsing. NotAI does not record webcams, capture screens, or monitor students outside the assessment context: detection is based on interaction signals, not surveillance.
How does NotAI support FERPA obligations?
NotAI operates in service-provider alignment that supports institutions' FERPA obligations. Institutions remain in control of their student records, and NotAI processes data on the institution's behalf under the terms of our Data Processing Agreement.
How does COPPA apply to NotAI?
NotAI follows a school-consent model. The service is provided to educational institutions rather than directly to children, and consent is obtained through the school in the educational context. NotAI offers no direct-to-child service.
What is your posture under NY Education Law 2-d?
NotAI publishes a Parents' Bill of Rights for Data Privacy and Security on our main site. It describes the protections applied to student data in New York institutional deployments and the rights parents hold under Education Law 2-d.
How is data encrypted?
Data is encrypted in transit using TLS only and encrypted at rest. Magic-link authentication material is encrypted with customer-managed keys held in Azure Key Vault. Authentication uses passwordless magic links, so NotAI stores no passwords at all.
Who are your subprocessors?
NotAI uses Microsoft Azure for cloud infrastructure, Cloudflare for CDN, WAF, and DDoS protection with Azure Front Door as failover, Constellix (DigiCert) for primary DNS management, Twilio SendGrid for transactional email, and Stripe for payments; card data is never stored by NotAI. The full list, including purposes, data categories, locations, and safeguards, is maintained on our subprocessors page.
Do you perform penetration testing?
Independent penetration testing is part of our security program, as warranted in our Data Processing Agreement. Executive summaries are shared with customers under NDA through the resource library.
Can I get your SOC 2 report?
Yes. NotAI maintains a SOC 2 Type II attestation, refreshed annually. The current report is available to customers under NDA through the resource library.
How do I get access to restricted documents?
Enterprise customers download restricted documents from the Documents section of the NotAI dashboard. Everyone else can request access on our access page. Documents are shared under NDA and delivered through watermarked, expiring links - never permanent URLs.
Do you provide HECVAT or VPAT documentation?
Yes. HECVAT Full and HECVAT Lite questionnaire responses and our accessibility conformance report (VPAT) are available as restricted documents through the resource library. These are the standard artifacts higher-education procurement and accessibility reviews ask for.
How do I report a security vulnerability?
Follow our vulnerability disclosure policy. It explains how to submit a report, what is in scope, and the safe-harbor commitments we make to researchers acting in good faith. We welcome reports from anyone, not only customers.
Have a question we did not cover?
Request enterprise access to our restricted documentation, or write to us directly. We answer security and privacy questions from customers, prospects, auditors, and parents.