Privacy Policy
How NotAI collects, uses, and protects personal data across the platform.
Trust Center
Documents & Resources
Every security, privacy, and compliance document we publish, in one place. Public policies are linked directly below. Restricted artifacts are listed so you can see exactly what exists; enterprise customers download them from the NotAI dashboard, and everyone else can request access.
Restricted documents are downloaded from the Documents section of the NotAI dashboard by enterprise customers. If your organization needs one of the documents below and does not have an enterprise account, request access and we will follow up by email.
Request accessPublic documents
These documents are published for everyone. Legal policies live on the main NotAI site; the subprocessor list and vulnerability disclosure policy live here in the Trust Center.
Terms of Service
The agreement that governs use of the NotAI platform and services.
Data Processing Agreement
Our DPA with EU Standard Contractual Clauses and the UK IDTA, applicable to all customers.
AI Transparency Notice
Our EU AI Act Article 50 transparency disclosure describing how NotAI detection works.
NY Parents' Bill of Rights
Our Parents' Bill of Rights notice under New York Education Law Section 2-d.
Subprocessor List
Every third-party subprocessor we use, with purpose, location, and safeguards.
Vulnerability Disclosure Policy
How to report a security issue to NotAI, and the safe harbor we extend to researchers.
Restricted documents
These artifacts are listed publicly so you can see what exists, but downloads are limited to enterprise customers and approved reviewers. Enterprise customers can download them from the Documents section of the NotAI dashboard. Everyone else can request access by email.
SOC 2 Type II report
Independent service auditor's report covering our security, availability, and confidentiality controls. The attestation is refreshed annually.
Penetration test executive summary
Executive summary of independent penetration testing of the platform, covering scope, methodology, and remediation status. Shared under NDA.
HECVAT Full
HECVAT Full questionnaire response for higher-education vendor security reviews.
HECVAT Lite
HECVAT Lite questionnaire response for streamlined vendor reviews.
Accessibility report (VPAT)
Accessibility conformance report covering WCAG 2.1 and Section 508 for the dashboard and student-facing surfaces.
CAIQ Lite
CAIQ Lite questionnaire response mapped to CSA Cloud Controls Matrix domains.
Architecture & data-flow diagrams
Architecture and data-flow diagrams showing how detection data moves through the platform.
BC/DR summary
Summary of business continuity and disaster recovery planning, including recovery time and recovery point objectives.
Cyber liability insurance certificate
Certificate of insurance for cyber liability coverage.
Incident response plan summary
Summary of our incident response plan, covering roles, severity classification, and customer notification.
DPIA support pack
Supporting materials for institutional data protection impact assessments and privacy reviews.
W-9
Completed IRS Form W-9 for procurement and vendor onboarding.
Need a restricted document?
Email us your name, work email, and organization, and we review the request within two business days. Approved reviewers accept a click-through NDA, and documents are delivered in the dashboard through watermarked, expiring links - never permanent URLs.
Request access