Certifications and Data Transfers

This page answers the two questions schools most often raise when reviewing Edexia's terms: what our ISO 27001 and SOC 2 Type II certifications mean, and whether de-identified student work, including handwritten scans, is ever sent overseas.

It is a plain-language walkthrough of claims already made in our Security Measures, Subprocessor List, and Privacy Policy. Those documents remain the legal source of truth.

Formal certification, not informal alignment

Edexia is independently certified to ISO 27001 and SOC 2 Type II. An independent auditor has assessed our information security management system and operating controls against those standards and issued certificates. We also hold ST4S (Safer Technologies 4 Schools) accreditation.

That is different from language such as “supports”, “aligns with”, or “based on” a standard. Those phrases can mean a vendor follows some of the practices without holding a current certificate. We hold the certificates. Audit reports are available to schools on request via admin@edexia.ai.

Identifiable data stays in Australia. De-identified text may travel.

Two different things get asked as one question. They have different answers.

• Identifiable student information (names, IDs, and any other identifier) is stored on Australian servers and is not sent overseas.
• De-identified assessment text may be processed by a small number of overseas subprocessors after identifiers have been stripped in Australia. The current list is in the Subprocessor List. GPTZero (AI writing detection, United States) is the example that receives de-identified student submissions.

De-identification runs on Edexia's self-hosted model in AWS Sydney before any external AI provider sees the work. Identifiers are replaced with a category placeholder so the assessment stays readable and gradeable without the underlying name or ID. Foundational language model providers (Anthropic Claude and Google Gemini) process that de-identified assessment text in Australia.

Handwritten scanned work

A handwritten scan follows the same rule, with one extra step at the start.

1. The scan is stored on Australian servers (AWS Sydney / Supabase Sydney).
2. Transcription runs in Australia. The original scan stays there.
3. The resulting text is de-identified in Australia. A name written on the page is treated as an identifier and stripped at this step.
4. Only after that step can de-identified text be sent to an overseas subprocessor. Identifiable student information does not leave Australia.

So: de-identified information can be transmitted overseas. Identifiable information, including a name on a handwritten page, is not. The same de-identification step applies to typed work and to transcribed handwriting.

Where to read more

• Security Measures — technical and organisational controls, including the de-identification process.
• Subprocessor List — each processor, location, and whether it may contain student personal information.
• Privacy Policy — collection, use, and overseas disclosure.