Technology & Security

How it is built and how it protects.

Public: a general overview of operation in the EU, data protection and the handling of AI. The in-depth details — architecture, data flows, individual protective measures — are visible only to signed-in administration and operators.

Technical details after sign-in only

Architecture, data flows and protective measures in detail are meant for the institution's auditors and are not public. Signed-in administration and operators see them here in full.

For

Status

14 of 14 entries

Technology & Securityin depthHow the platform is builtA web application that runs in the browser, with a relational database in Frankfurt and data centres in the EU — multi-tenant, multilingual, secured by thousands of automated tests.StudentsTeaching staffAdministrationOperator
Technology & Securityin depthOperation and data in the EUData and processing are in the EU — as a hard rule in the code that an automated test checks on every change, not as a default.StudentsTeaching staffAdministrationOperator
Technology & Securityin depthAI on the platform — what it may and may not doAI writes suggestions, presents courses and answers questions — labelled, bound to sources and with fixed limits: it does not assess exam behaviour and decides nothing that a person must decide.StudentsTeaching staffAdministrationOperator
Technology & Securityin depthArchitecture and hostingThe building blocks of the installation, their locations and how a request runs through them.AdministrationOperator
Technology & Securityin depthDatabase and tenant separationEvery table carries the organisation; the database itself decides who sees which row.AdministrationOperator
Technology & Securityin depthAI models and speech servicesWhich kind of service is used for what, where it works and what it gets to see — described by function, not by provider.AdministrationOperator
Technology & Securityin depthSign-in, second factor and encryptionHow accounts, sessions and secrets are protected.AdministrationOperator
Technology & Securityin depthProtection against injected code and abuseContent security policy with a nonce per request, origin check, limits per network address and bot defence.Operator
Technology & Securityin depthAI guardrailsImmutable rules before every model call, a deterministic check of every input and a check of every output — with a log.AdministrationOperator
Technology & Securityin depthCost recording and usage limitsEvery call to an external service goes through one single recording point; limits apply in stages.Operator
Technology & Securityin depthBackground runsScheduled runs for reminders, cost warnings, reports, fact checks, deletion calendar, learning data and pre-production.Operator
Technology & Securityin depthTests and guardsAround 3,400 automated tests, including 142 guards that permanently prevent mistakes once made — each with a counter-check.Operator
Technology & Securityin depthData flowsWhat flows where when a question is asked in a course, when a course is built and when an exam is taken.AdministrationOperator
Technology & Securityin depthHonest limitsWhat is not yet documented or not yet built today — so that nobody assumes it exists.AdministrationOperator