Question 1

Where is the data hosted?

Accepted Answer

Application data (database, documents) is hosted in the European Union, on Supabase in Ireland (eu-west-1 region); the website is served by Vercel from Dublin. Optional 100% EU AI processing, knowledge base included, with Mistral or Edugent's own instances hosted by OVH in France, for institutions that require this level of sovereignty. Transfers outside the EU are governed by the Standard Contractual Clauses; the full list of sub-processors is in our legal notice.

Question 2

Who is the controller (GDPR)?

Accepted Answer

Your institution is the controller; Edugent is a processor within the meaning of the GDPR. The standard data processing agreement (DPA) complies with the European Commission's Standard Contractual Clauses (2021).

Question 3

How does Edugent meet Article 14 of the AI Act (human oversight)?

Accepted Answer

By design, through the twin principles: decisions always remain human. The twin writes drafts that an identified human approves, edits or rejects, and every module run and every kill switch is recorded in the audit log.

Question 4

How does Edugent meet Article 50 (transparency)?

Accepted Answer

By default, a transparency line at the foot of every message prepared by a twin (“Message prepared with the help of an AI assistant and reviewed by Sophie Martin before sending.”), and a “Write to [name] in person” button on the twin's public page. No student can be trapped in a dialogue with an agent.

Question 5

Why 2 December 2027?

Accepted Answer

The date from which the obligations apply to the high-risk systems listed in Annex III of the AI Act (which covers certain uses in education: admission, assessment, exam proctoring), as amended by Regulation (EU) 2026/1744 published on 24 July 2026.

Question 6

What does the audit log contain?

Accepted Answer

Metadata, for each action: who (user, system or platform), with which agent or module, what (module run, AI model calls, kill switch, key change or support intervention, appointment, record viewed), when (UTC) and the cost in credits. Never the content of exchanges nor the instructions sent to the model. Kept for one year at most, exportable as CSV by your administrator.

Question 7

What is the policy on third-party AI models?

Accepted Answer

Edugent is compatible with Claude, GPT, Mistral and its own instances hosted by OVH in France. Claude is the default choice for your agents, configured with no retention of submitted content; the other models are only enabled at your institution's explicit choice, and image generation, if you enable it for a role, goes through GPT, or through OVH if your institution requires that provider. No training on your data, no use for any purpose other than the requested generation. The full list of sub-processors is in our legal notice.

Question 8

How is a GDPR request (right of access, erasure) handled?

Accepted Answer

Your administrator sends the request to Edugent; the person's data is extracted and, if requested, erased within the legal time limit of one month, with written confirmation.

GDPR and AI Act compliance by design

Data hosted in the EU

Encryption in transit and at rest

Everything is logged

Compliant today, ahead of the AI Act deadline

Human oversight

Transparency

High risk

Questions from CIOs and DPOs

Talk to our security team