Student data belongs to the institution.
Palatinum is built for programs with real procurement review — FERPA DPAs, SOC 2 reporting, per-tenant isolation. The posture is public so your security team doesn't have to ask.
SOC 2 Type II
In progress — audit opened Q1 2026, Type I report available on request
FERPA
Operated as a school official with legitimate educational interest; signed DPAs standard on all plans
Encryption
TLS 1.3 in transit, AES-256 at rest. Keys managed via AWS KMS with per-tenant isolation
Data isolation
Per-tenant databases. Student data is never used to train shared models or crossed between institutions
Hosting
AWS us-east-1 and us-west-2 for US customers. Dedicated regions available on Institution plans
Access control
Role-based access, SSO-enforced login, mandatory 2FA for admin accounts, audit log retained for 7 years
Practices
Student data handling
Student records are processed only to deliver the service you contracted. Nothing is sold, nothing is used for behavioural advertising, nothing is shared outside your tenant without written instruction from your institution.
Subprocessors
A current list of subprocessors is maintained at palatinum.app/legal/subprocessors. We give 30 days' notice before adding a new one and offer institutions a termination right on material changes.
Incident response
Security incidents are triaged within 1 hour, with written customer notification within 72 hours. Post-incident reports are shared with affected institutions. Status page: status.palatinum.app.
Vulnerability disclosure
Security researchers can report findings at security@palatinum.app. We publish advisories and patch windows for infrastructure CVEs that affect our platform.
Need something specific?
Procurement, legal, and security teams can request SOC 2 reports, DPAs, security questionnaires (CAIQ, SIG), and pen test summaries directly.