Security & trust

Your course is yours.
We keep it that way.

When you upload your materials and your students do their work in Kova, that data belongs to you — and it's our job to protect it. Kova is built on Vercel and Supabase, the same production infrastructure trusted by thousands of companies, with encryption and strict access controls at every layer. Here's exactly how we handle it.

How we protect your data

Built to keep
your data safe.

Encrypted, always
Everything you and your students send travels over encrypted connections (TLS/HTTPS), and is encrypted at rest in the database. Your data is never sitting in the open.
Isolated by design
Row-level security is enforced on every request, so each account — professor, student, or TA — can only ever reach its own data. One class can never see another's.
Your materials stay yours
You own everything you upload. We don't sell your data, and we don't share your course materials or your students' work with other customers.
Not training data
We don't use your private course materials or your students' work to train AI models. Your content is used to run your class — nothing else.
Protected access
Sign-in, sessions, and permissions run on Supabase Auth. Passwords are hashed, sessions are secured, and access is scoped to exactly who should have it.
You're in control
Your data is yours to take with you or remove. Delete your account or your content whenever you want, and it's cleared from our systems.
A few promises

What we'll never do.

✕Sell your data, or your students' data, to anyone.
✕Use your private course materials or student work to train AI models.
✕Share one instructor's or institution's data with another.
✕Hold your data hostage — you can export or delete it at any time.
FERPA

FERPA-aligned, by contract
and by design.

✓A school official, under your control. When a school uses Kova under an agreement with us, we act as a school official with a legitimate educational interest, and the school keeps direct control over how we use and maintain its education records.
✓Used only to provide Kova. We use education records only to provide Kova to the school, as our agreement and Privacy Policy describe. We never sell them, never use them for advertising and never use them to train AI models.
✓No re-disclosure. We don’t disclose education records except as FERPA and the school allow. The providers that help us run Kova, such as Supabase, Vercel and Anthropic, may use data only to provide their services to us, and they are listed in our Privacy Policy.
✓Records requests go through the school. Parents and eligible students ask their school to see or correct records, and we help the school respond. When an agreement ends, we return or delete the school’s information as the agreement requires.
✓Breach notice. If a security breach affects student information, we notify the school without unreasonable delay and as the law requires.
Students see only their own
Row-level security in the database, not just the page, means a student can open their own work, grades and feedback - never a classmate’s.
Names stay out of the AI
When an instructor asks Elvis or another AI tool about the class, each student’s name is replaced with a label like “[Student 1]” before anything is sent, and the page puts the names back.
Canvas import is course content only
Importing a course from Canvas brings in your materials and never reads student submissions, grades, enrollments or discussions - an automated check keeps it that way.

The details for your institution - data handling, deletion timelines and any state student-privacy requirements - are set in your data privacy agreement with us, which we work through with your IT and legal teams. Read how our Privacy Policy covers schools, or email privacy@kovaedu.com.

For institutions

Rolling out across
a department or campus?

Student records carry real obligations under laws like FERPA, and those obligations sit with your institution. We take that seriously: for institutional deployments we work directly with your IT and legal teams on the data-processing agreement, access controls, and single sign-on your institution requires — and we're happy to walk your reviewers through exactly how Kova stores and protects data.

If your team has a security questionnaire or specific requirements, send them our way and we'll work through them with you.

Questions about security?

We're glad to answer them — from a quick question to a full review. Reach out and we'll get you what you need.

Email us about security Talk to the team