Security, privacy, and how our AI handles school data
Schools trust us with student, family, and staff records. This page explains, in plain language, how that data is protected, what our AI can and cannot see, and every outside provider that touches it.
Four promises we build around.
Last updated:
Your data never trains AI
Relyant does not use school data to train AI models. Our AI provider, OpenAI, does not train on data sent through its API by default.
AI sees only what you can
The assistant runs with your own permissions. A teacher's question only reaches their own classes, and a parent never reaches another family.
Your school stays in charge
Your school controls its data. Admins choose who sees what, can switch AI off, and can export everything as CSV on any plan.
Every school is walled off
Each school's records are kept apart from every other school. Data is encrypted in transit and at rest, and important actions are logged.
What happens when someone asks Relyant AI a question.
Ask AI answers questions like "Which students missed three days this week?" by looking up records for you. It is built so it can never reach further than the person asking.
Step by step
- 1
Your school switches it on
Ask AI is a module. It only works for schools whose admins have turned it on, and only for signed-in staff.
- 2
Your permissions travel with the question
Every lookup the AI makes is checked against your role, just like opening the page yourself. Teachers only reach their assigned classes. Sensitive HR fields stay hidden without HR permission.
- 3
Only the records needed are sent
The question and the records needed to answer it are sent to OpenAI to write the answer. OpenAI does not train on data sent through its API by default.
- 4
Changes need your confirmation
If the AI suggests creating or changing something, you see a confirmation card first. Nothing is saved until you approve it.
- 5
The conversation stays in your workspace
Chats are stored in your school's Relyant workspace, visible only to you, and you can delete them. Each question is recorded in the school's audit log.
Meeting recordings (Scribe)
Audio is transcribed by ElevenLabs, then deleted from our storage by default. Only the transcript, summary, and notes are kept, unless the meeting owner turns on audio retention.
Connecting other AI tools
Schools can connect AI apps such as Claude or ChatGPT to Relyant. That connection is read-only, needs each person to sign in and approve it, respects their permissions, and every lookup is logged.
Built-in guardrails
Questions are length-limited and rate-limited, and attempts to make the AI ignore its rules are filtered out. Attached images and PDFs are used for the answer, not stored.
Built in, on every plan.
These protections are part of the platform, not add-ons.
Access and sign-in
- Sign in with a one-time email code (valid for 5 minutes), a password, or Google.
- Passwords are stored only as one-way hashes.
- Sessions end after 30 days of inactivity. Sign-in attempts are rate-limited.
- On phones, the sign-in session is kept in the operating system's encrypted secure storage.
Who sees what
- Role-based access with built-in and custom roles, enforced on every request.
- Teachers reach only the classes they are assigned to.
- Parents see only their own children, through a limited set of fields.
- ID numbers, tax numbers, and bank details in HR records are hidden without special permission, and every view is logged.
Infrastructure
- Hosted on Cloudflare's network, with HTTPS/TLS for all traffic.
- Databases and files are encrypted at rest by Cloudflare.
- Payment-gateway keys are sealed with AES-256-GCM. Relyant never stores full card numbers.
- Payment and transcription callbacks are verified with signed webhooks.
Visibility and your data
- An audit log that school admins can review: who did what and when, including exports, AI questions, and Relyant support access.
- Bot protection and rate limits on public forms.
- Export your school's data as CSV at any time, on any plan.
- Account deletion on request within 30 days. Deleted help desk tickets are purged after 30 days.
Every provider that handles your data.
We keep this list short and name every provider. Each may only use data to provide its service to us.
| Provider | What we use it for | What it receives |
|---|---|---|
| Cloudflare | What we use it for: Hosting, database, file storage, sign-in sessions, bot protection | What it receives: All data stored in Relyant |
| OpenAI | What we use it for: Ask AI, student insights, meeting summaries and Q&A | What it receives: Questions, and the records or transcripts needed to answer them |
| ElevenLabs | What we use it for: Speech-to-text for Scribe meetings | What it receives: Meeting audio |
| Resend | What we use it for: Transactional email | What it receives: Email address, sign-in codes, notification content |
| PostHog | What we use it for: Product analytics, error reports, session replay | What it receives: Usage events, name and email; typed text and images masked on mobile |
| What we use it for: Sign in with Google, Maps and Places, Calendar and Docs if connected | What it receives: Profile basics, addresses you search, events and notes you sync | |
| Stripe | What we use it for: Relyant subscriptions, and school payments if connected | What it receives: Billing and payment details |
| HitPay | What we use it for: School shop and point-of-sale payments, if connected | What it receives: Order and payment details |
| Expo, Apple, Google | What we use it for: Mobile app updates and push notifications | What it receives: Device push token, notification title and text |
| Vercel, HubSpot | What we use it for: This website and its contact forms | What it receives: Website visits and form submissions |
Our providers run globally, so data may be processed outside your country, including in the United States. We protect international transfers as Indonesia's UU PDP, Singapore's PDPA, and the GDPR require.
Full details in our Privacy PolicyFound a security issue?
Email hello@relyant.app with "Security" in the subject. We read every report and will reply.
Questions schools ask us.
No. Relyant does not use your data to train AI models, and OpenAI, the provider behind our AI features, does not train on data sent through its API by default.
Have a question for
our team?
Tell us what your school needs to know. We will walk your IT or data protection lead through how Relyant handles your data.
See pricing