How does Thinking Mode protect and manage school data?
Where your data is stored, who can see it, how long we keep it, and what happens if there’s a data breach.
This is a summary for school leaders, IT teams and privacy officers. The full details are in the documents listed at the end.
Where your data is stored
All school, staff and student data is stored in Australia, with Amazon Web Services in Sydney. Our database backups are kept in Sydney too, and expire after 14 days.
What we collect from students
Students don’t have accounts or passwords. They join a task with an access code from their teacher. By default, we collect no student personal information beyond what the student types or uploads in the task.
Each student session is signed so it can’t be forged, lasts no more than 8 hours, and can only reach that one task.
Voice features are off by default. When a teacher turns them on, speech is turned into text in Sydney and the audio is not kept.
Signing in
Staff sign in with Google Workspace, Microsoft 365, or an email address and password.
Passwords must be at least 14 characters. We store them only in hashed form, and we reject passwords that are known to have been leaked.
Two-step verification is available to every staff account, and is enforced for coordinators.
Repeated failed sign-ins lock the account for a time.
Who can see your data
Each school’s data is kept separate from every other school’s. Inside a school, teachers see their own tasks and any shared with them, and coordinators see their school’s. A small number of named Thinking Mode staff can reach production systems, each with their own account.
Encryption
All traffic to and from Thinking Mode is encrypted (TLS 1.2 or higher). Stored data and files are encrypted at rest.
AI providers
Student conversations and evaluations are processed by AI providers under terms that do not allow them to train their models on your data. Anthropic’s Claude models run in Australia, through Amazon Web Services in Sydney. OpenAI models run in the United States. The full list is in the sub-processor register in our Data Processing Agreement.
How we protect the platform
A web application firewall and rate limits filter malicious traffic.
Continuous threat detection and audit logging run across our cloud account.
Every code change is reviewed and tested before release.
Security updates to the software we depend on are applied promptly, and we carry out regular security testing.
If there’s a data breach
If we confirm or reasonably suspect that a school’s data is involved in a security incident, we:
contain and assess it straight away;
contact the school within 3 business days, without waiting for any regulator assessment;
send updates at least every 7 days while we investigate and resolve it, and a final report when it is closed;
notify the Office of the Australian Information Commissioner and the people affected when the Notifiable Data Breaches scheme requires it (students are told through their school, because they have no account or email address with us);
review what happened within 10 business days of closing the incident, and fix the cause.
Managing your data
We sort data by how sensitive it is, and each person can reach only what their role needs.
Student session data is kept for 365 days after the student’s last activity on school plans (120 days on personal plans), unless your school sets its own period. It is then archived for 30 days and permanently deleted.
The content of safety alerts is removed after 12 months. Security logs are deleted after 2 years. Database backups expire after 14 days.
Your school can ask us to delete its data earlier at any time. When a school leaves Thinking Mode, its data is deleted.
We respond to requests to access or correct personal information within 30 days. Email privacy@thinkingmode.com.
Standards and insurance
Our security controls follow the NIST Cybersecurity Framework, and we are working towards alignment with ISO/IEC 27001. We hold public liability and cyber insurance.
Documents
Data Processing Agreement, including the sub-processor register
Service Schedule: hosting, availability and support
Information Security Policy: the full policy
School coordinators can sign in to read our full Data Breach Response Plan and Data Management Standard.
Questions? Email privacy@thinkingmode.com.