Section 1 — Security & Data Protection

How We Protect Student Data

Encryption

All data is encrypted in transit using TLS 1.2+ and at rest using AES-256. This includes voice recordings, transcripts, grades, and all other student information.

Tenant Isolation

Each institution's data is kept strictly separate from every other institution's through row-level security in the database.

Access Controls

Access to student data is limited to personnel who need it to operate the service. All access is logged and auditable. Admin access requires multi-factor authentication.

Vulnerability Management

Automated dependency scanning on every code change (GitHub Dependabot). Critical vulnerabilities patched within 7 days; high-severity within 30 days. Security reviews at every major release; a third-party penetration test is commissioned ahead of our SOC 2 audit.

Breach Notification

If a data breach affects student data, we notify affected institutions within 72 hours of becoming aware, consistent with GDPR Article 33 (EEA/UK), Korea PIPA Article 34, and equivalent national requirements elsewhere.

Data Deletion

Voice recordings are automatically deleted 90 days after the grade for that interview is released, or 180 days after the interview if no grade is released. The countdown pauses while an integrity flag, a grade review or an instructor-granted retry is open on that interview, or while the institution holds a documented, time-limited hold on the class. Voice ID voiceprints are deleted within 30 days after Voice ID is turned off, consent is withdrawn or the student stops being eligible, within 90 days after account closure or the end of the contract, and in any case within 1 year after the student's last use of Viva. Camera Check signals and flagged still images are deleted on the same schedule as the interview record. All other student data is deleted after the contract ends, on the schedule in the school's DPA. Written deletion confirmation is provided on request.

Optional Integrity Features

Voice ID is on by default in eligible classes (Grade 9–12 and higher education) unless the school turns it off. It is never offered in Grade 6–8 classes, or to students under 14 in Korea. A short voice sample confirms the student taking the interview is the student who submitted the work; it is never used for grading, only to flag possible impersonation to the instructor. Each student gives their own consent on Voice ID's standalone screen before their first interview, and nothing is captured before that. In Illinois, adult university students sign the written release BIPA requires; for students under 18, the school must first sign a BIPA Rider.

Camera Check is used where the school turns it on, for the classes the school chooses. It does not identify students, so outside the US it is part of the school's assessment and students are told about it before their first interview; in the US, each student also consents on a standalone screen. In Illinois, whose law lists a scan of face geometry as biometric, it is used only for students 18 or older who sign a written release. If a student's camera is off or unavailable, the interview goes ahead without it.

• Voice ID (voice identity). A short voice sample used only to confirm the student taking the interview is the student who submitted the work, and to flag possible impersonation to the instructor. Never used for grading. Render computes the voiceprint on Viva's behalf and keeps no audio or voiceprint afterward, and Supabase stores it encrypted in Viva's database; they are the only subprocessors that receive this data.
• Camera Check (gaze and presence). The student's camera derives simple attention and presence signals. Face and gaze analysis runs locally in the student's browser; live video is never transmitted to Viva or any subprocessor. Viva keeps only derived numeric signals and a small number of flagged still images. The feature does not identify a student from their face and creates no faceprint — identity checking, where enabled, is done by Voice ID, not the camera.

A student may decline Voice ID, or turn it off, at any time, and can ask the school to turn off Camera Check. They take the same interview without that feature, with no penalty and no effect on their grade.

Our Subprocessors

We work with a small number of trusted technology providers to operate the platform. Subprocessors are primarily based in the United States; Supabase and PostHog each offer EU/UK data residency options. Each is bound by a written data processing agreement with terms no less protective than our own.

Slack. Viva uses Slack for internal operational alerting (system health, usage metrics, and de-identified product-feedback summaries). No Student Data or other personal data is transmitted to Slack, so Slack is not acting as a subprocessor of personal data.

SOC 2 Readiness

Viva is currently in the SOC 2 Type II readiness phase. Our controls are operating today. The formal audit period and Type II report are targeted for 2027.

Deployment Options

Managed cloud (standard). Signed DPAs, the subprocessor list, encryption in transit and at rest, regional hosting commitments available under contract.

Private deployment (enterprise, in rollout). Single-tenant deployment inside your institution's own cloud environment and region, with AI running through your institution's own AWS Bedrock service. Prompts and responses are not sent to Anthropic or Viva's shared infrastructure. Contact us to scope a private deployment.

Section 2 — Education Privacy Compliance

Viva is designed to comply with education privacy laws across every jurisdiction we serve. Below we explain our obligations under the two primary US frameworks. If your institution is located outside the US, we work with you to put the appropriate compliance documentation in place. Contact privacy@vivaproof.com for details relevant to your country.

FERPA (United States)

What Is FERPA?

The Family Educational Rights and Privacy Act (FERPA) is a US federal law that protects the privacy of student education records. It gives parents and eligible students the right to inspect, correct, and control access to education records.

Viva's Role Under FERPA

Viva acts as a "school official" with a "legitimate educational interest" in student data, as defined under 34 CFR § 99.31(a)(1)(i)(B). This means:

• We perform a service for which the school would otherwise use its own employees, specifically, conducting oral assessments and generating AI-suggested grades
• We are under the direct control of the school with respect to the use and maintenance of student data
• We are bound by the same use-and-redisclosure restrictions that apply under 34 CFR § 99.33(a)

What We Do Not Do

• We do not share student education records with third parties except as necessary to provide the service
• We do not use student data for advertising or commercial purposes unrelated to the school's educational purpose
• We do not disclose personally identifiable information except as permitted by the school or required by law

Parental and Student Rights

Students who are 18 or older (or who attend a post-secondary institution) hold their own FERPA rights. Parents hold FERPA rights for students under 18. Through their school, parents and eligible students may inspect, request correction of, and control disclosure of education records.

For questions about FERPA rights, contact your school's registrar or data protection contact, who will liaise with Viva.

COPPA (United States — Under-13 Students)

For students under 13, Viva acts as a service provider to schools under the Children's Online Privacy Protection Act (COPPA). The school authorizes Viva to collect and use students' information only for the school's educational purpose. Viva never uses it for advertising, profiling, AI training or any other commercial purpose, and deletes it at the school's request.

Other Jurisdictions

Viva maintains equivalent compliance documentation and contractual addenda for other jurisdictions, including (but not limited to):

• Republic of Korea: PIPA (Personal Information Protection Act). Written entrustment agreement (Article 26), overseas-transfer disclosure (Article 28-8), the student's own consent for Voice ID (Article 23, never offered under 14), and pseudonymized data for research only where the school authorizes it (Article 28-2).
• EEA / UK: EU GDPR / UK GDPR — Standard Contractual Clauses (SCCs), UK IDTA, data subject rights
• Other national laws: available on request

Contact privacy@vivaproof.com for compliance documentation specific to your institution's jurisdiction.

Section 3 — Data & AI Ethics

Our Approach to AI in Education

The Instructor Always Decides

Every AI-generated grade and piece of feedback in Viva is advisory. An instructor is responsible for every grade and can override any AI suggestion at any time, for any reason, without explanation.

Transparency

When Viva generates a suggested grade, the AI also produces a structured rationale explaining why. Students can request access to their interview recording and transcript through their institution.

Camera-Based Integrity, and the Line We Do Not Cross

• We do not infer emotion. Prohibited under Article 5(1)(f) of the EU AI Act, and we don't build or operate Camera Check to do it.
• We do not identify by face. No faceprint, no facial-recognition template.
• It never decides anything. Camera Check signals are advisory indicators surfaced to an instructor, exactly like AI-suggested grades.
• It runs on the student's device. Live video never leaves the student's own browser.

Responsible Data Use

We do not sell student data, ever. We do not use it for advertising. We train our own models only on data with students' names and other identifiers removed, never on voice recordings, voice-identity templates or Camera Check data, and never on data from Grade 6–8 classes or students we know to be under 14. For US universities and US Grade 9–12 this is on by default; in Korea it happens where the school authorizes it; elsewhere only with the school's written agreement. Any student can opt out at any time, in Settings or by email, with no effect on their grades.

Student Voice and Agency

Students are informed about how Viva works before their first interview through the Privacy Policy's Students & Families section. They are told before their first interview that it is recorded so their instructor can review it, and, where the school uses Camera Check, how it works. Voice ID requires their own separate consent on its own screen, as does Camera Check in the US (in Illinois, a signed written release), and they can decline or turn off Voice ID at any time without penalty. They can opt out of AI training in Settings or by email. They can request access to their recording. They can raise concerns about their assessment with their instructor. Viva does not make educational decisions about students; institutions do.