Infrastructure
Hosted in the EU
Database and file storage in the European Union.
Encrypted in transit
All traffic over TLS 1.2 or higher.
Encrypted at rest
AES-256 for stored data.
Private file storage
Exam photos and submissions in an EU bucket with private access.
Authentication
Hashed passwords
Hashed with bcrypt — never stored in plain text.
Short-lived sessions
JWT tokens that expire automatically.
Row-Level Security
Enforced at the database level: a teacher only sees their own exams and those of classes shared with them.
Access control
API requests for another teacher's resource return a 404 (not a 403), so as not to confirm that another user's data exists. This is a deliberate privacy measure.
External services
- Hosting and database — database, authentication and file storage in the EU.
- AI processing for grading — our AI provider does not use submitted data for model training. GraidLens itself trains no model on your data unless you explicitly switch that on (see privacy policy).
- Where AI processing happens — for grading, photos and answers go to an AI service. That processing currently takes place outside the EU (US); moving it to processing within the EU is planned. Which service this is, is listed on the Privacy & sub-processors page.
Which parties process data on our behalf — with purpose, location and safeguards per party — is set out in the data processing agreement, which schools receive on request.
Two-step verification
Teachers can switch on two-step verification with an authenticator app. An account with a second step only gets into the app after the code, and the API refuses a session without that step.
Retention
Photos of student work are deleted automatically: after 3 months for a regular test and after 1 year for a school exam, so that inspection and appeals remain possible. Grades and scores per question are kept as long as the test exists. A teacher can always delete a test earlier.
Audits by schools
A school may check that we keep to our agreements: by asking questions, requesting documentation or carrying out an audit, as set out in the data processing agreement.
What we don't have (yet)
- No ISO 27001 or NEN 7510 certification.
- No external penetration test yet; we will have one before the national release.
- Not yet part of the Dutch Privacy Covenant for Education; the application is being prepared.
- No AI processing within the EU yet; see above.
Responsible disclosure
Found a vulnerability? Report it responsibly to security@graidlens.eu. We aim to confirm reports within 48 hours.