Institutional Data Processing Overview
Edition 2026-10-30.1. Documents approved. Contractual acceptance is not enabled.
These documents have been approved. Account acceptance will be requested when enabled for this release.
Separate institutional agreement
This overview is not a signed Data Processing Addendum and is not accepted on behalf of an institution by an individual checkbox. Before institutional rollout, authorized representatives must establish controller and processor roles, processing purposes, duration, categories of data and learners, and documented instructions.
Required agreement topics
The institutional agreement should address authorized access and confidentiality, security measures, subprocessors and change notification, international transfers and applicable safeguards, incident notification, assistance with rights requests and assessments, audit information, end-of-service return or deletion, preservation exceptions and backup treatment. Student-record requirements, including FERPA where applicable, need an institution-specific assessment.
Operating limits
One active cohort per learner, role-scoped reports and retained history are application features; they are not a compliance certification. The recorded institution retention period is not automatic deletion. The parties must agree on a practical procedure and responsibilities before promising operational retention enforcement.