Ekadem
Security overview

Built to reduce the blast radius.

The safeguards Ekadem uses, and the assurance work still required before broad school launch.

Updated 4 August 2026

Core safeguards

  • encryption in transit and at rest through the configured cloud services;
  • school, class, role and membership authorization enforced server-side;
  • least-privilege access, protected secrets and MFA for privileged vendor/admin accounts;
  • separate data stores for requested school deployments and enforced AI provider selection;
  • audit and security event logging, rate limiting and abuse protections;
  • secure development review, dependency scanning, vulnerability handling and controlled deployment;
  • backups, restoration planning, retention controls and documented incident response; and
  • vendor due diligence and contractual restrictions before approval for school data.

AI and data minimization

School AI is designed to fail closed if the school approval or provider route is missing. Approved routes require no-training settings, a named model endpoint and minimal context. Prompt/response text is kept out of general usage analytics.

Incidents

We triage reports, contain access, preserve evidence, assess affected tenants and data, remediate and notify the responsible controller or person as law and contract require. The school DPA targets initial school notice within 24 hours after confirmation, with details supplied in phases. A shorter mandatory deadline controls.

Assurance status

No certification claimEkadem must complete an independent penetration test, remediation and evidence collection before broad institutional launch. Ekadem does not claim SOC 2, ISO 27001 or a completed WCAG conformance audit unless and until the relevant independent evidence exists.

Schools may request the security controls schedule, incident plan and vendor diligence evidence under appropriate confidentiality.

Report a vulnerability

Email security@ekadem.com with the affected URL, impact, reproduction steps and a safe proof. Do not access other people’s data, disrupt service, use social engineering or publish an unremediated issue. We will acknowledge and coordinate in good faith.