Built for institutions that answer to FERPA.
Last updated: 1 September 2026
LioraAI processes some of the most sensitive data an institution holds - student transcripts and records. Security and privacy are designed into every layer, not added afterward. This page summarizes our controls; institutions can request full documentation under NDA.
Compliance program
FERPA
EnlitEDU operates as a "school official" under each institution's direct control, processing records only to deliver contracted services and never re-disclosing them except as the institution directs.
SOC 2
We maintain a SOC 2 program covering security, availability, and confidentiality. Current report / bridge letter and status available under NDA.
Data Processing Agreement
A DPA is executed with every institutional customer, covering roles, sub-processors, breach notification, retention, and deletion.
State privacy laws
We support institutional compliance with state student-privacy and consumer-privacy laws, including data-subject request handling.
How data is protected
- Encryption: TLS 1.2+ in transit; AES-256 at rest.
- Access control: role-based access, least privilege, MFA for staff, and access reviews. Customer data is logically separated per institution.
- Audit trail: every evaluation decision produces an immutable record of the evidence reviewed, the AI recommendation, and the human decision - designed for accreditation review.
- Monitoring & response: logging, alerting, vulnerability management, and a documented incident-response plan with contractual breach-notification timelines.
- Infrastructure: hosted with a major cloud provider in U.S. regions; backups and disaster-recovery procedures in place.
- Personnel: background checks where permitted, confidentiality agreements, and annual security training.
AI and student data
Student education records are never used to train general-purpose or commercial AI models. LioraAI applies each institution's own rules and, where the institution opts in, learns only from that institution's historical decisions to improve suggestions for that institution. No customer's identifiable student data is used to benefit another customer.
Data retention & deletion
Institutions control retention through the DPA. On termination, EnlitEDU returns or securely deletes institutional data within the contractually specified window and can provide written confirmation of deletion.
Report a vulnerability
If you believe you have found a security issue, please email info@enlitedu.com with details. We appreciate responsible disclosure and will acknowledge your report promptly.
Security FAQ
LioraAI is built to be used in a FERPA-compliant manner. EnlitEDU acts as a school official under the institution's direct control, processes records only to perform contracted services, and does not re-disclose them except back to the institution or as it directs. A DPA governs every engagement.
Yes - we maintain a SOC 2 program covering security, availability, and confidentiality. Institutions can request the current report or bridge letter, and the current status, under NDA from info@enlitedu.com.
No. Student records are never used to train general-purpose or commercial models. With institutional opt-in, LioraAI learns only from that institution's own historical decisions.
TLS 1.2+ in transit and AES-256 at rest. Access is role-based, logged, and limited to personnel who need it to deliver the service.
With a major cloud provider in U.S. regions. Data is processed in the United States.
Need our security package?
We provide the SOC 2 report or bridge letter, DPA template, sub-processor list and a completed HECVAT under NDA.