Skip to main content

Server Security

Personal data used within the application is stored on servers within the European Economic Area.

Google Cloud​

We use the Google Cloud Platform (Firebase) for data storage.

Google Cloud Platform, including Firestore, works in accordance with various standards and certifications, including several ISO standards.

Some examples are:

ISO/IEC 27001: This is an international standard for information security management systems (ISMS), focused on protecting the confidentiality, integrity, and availability of information.

ISO/IEC 27017: This standard focuses on cloud-specific information security, with guidelines for both cloud service providers and cloud service users.

ISO/IEC 27018: This is a code for protecting personal data in the cloud, and is particularly relevant for services dealing with processing personal data.

In addition to ISO certifications, Google Cloud also complies with other standards and certifications such as SOC 1, SOC 2, and SOC 3, and the General Data Protection Regulation (GDPR) of the European Union.

Preventing Unauthorized Access​

We have taken various measures to ensure that only users with the proper rights have access to the data.

  • Login via Microsoft or Google school account. This is inherently safer than logging in via email and password. And it is also easier.

  • Assigning roles to application users: roles are student, employee, admin, board admin, and super admin. Access to data is limited per role.

  • Assigning environment rights: users only get access to the environment they belong to, unless the super admin role is assigned.

  • Setting up Security Rules in the Firestore database. Security Rules ensure that the assigned roles and environment rights are applied.

  • App Check ensures as a last step that only requests for information from authorized front-end applications are processed.

App Check​

"App Check" is a security feature of Firebase that helps protect backend resources from abuse, such as unauthorized access and app impersonation.

App Check works by verifying that incoming traffic to the Firebase backend comes from authentic, trusted instances of the AI-School app.