Security & Platform Overview

• Hosted on secure cloud infrastructure (AWS regions in the United States)
• Data stored in managed, secure environments with access restrictions
• Network-level protections and encrypted communication (TLS 1.2+)
• Separation between application, database, and storage layers
• Infrastructure provisioned and managed using established cloud services with security compliance track records

• Role-Based Access Control (RBAC) enforced across all platform layers
• Strict separation between student, university, and administrative data and permissions
• Secure authentication handled via trusted identity providers (credentials are not stored directly)
• Session management with expiration and protection against unauthorized access
• Administrative actions follow least-privilege enforcement and are logged for audit purposes

• Data encrypted in transit (TLS 1.2+) and at rest
• Uploaded documents stored securely with controlled access permissions
• Access to sensitive data restricted to authorized systems and personnel only
• Data retention aligned with operational and legal requirements
• No sale of personal data to third parties
• Payment data processed by Stripe — full card details are not stored on LinkEdu.AI servers

• Input validation and secure coding practices applied across the application
• Protection against common vulnerabilities (OWASP Top 10 awareness)
• Controlled API access with authentication and authorization enforcement
• Internal access logging and audit trails for administrative operations
• Regular system updates and dependency patching

• AI features are assistive, not authoritative — outputs support decision-making, not replace it
• AI-generated outputs are probabilistic and do not guarantee admission, visa, or enrollment outcomes
• Disclaimers and acknowledgment prompts are presented before AI feature usage
• AI interaction data is not used to train third-party models
• Full AI use policy publicly available

Full framework: AI Use Policy

• Consent captured at signup, subscription, document upload, and AI feature usage
• Policy versioning tracks re-consent requirements when policies are updated
• Role-based data visibility ensures users access only information relevant to their role
• Privacy rights requests supported for U.S. and international users
• All privacy policies publicly accessible without authentication

Full details: Privacy Policy

• Governing law and jurisdiction: Commonwealth of Virginia, United States
• All platform policies publicly available and accessible without authentication
• Data Processing Addendum (DPA) available for institutional customers upon request
• Subprocessor list maintained and publicly disclosed
• Designed to support GDPR-aligned data processing practices

• Security incidents are monitored and investigated promptly
• Access and activity logs support incident analysis and forensic review
• Affected parties are notified in accordance with applicable legal and contractual requirements