Separate
Identity stays outside the shared layer. Its match to the ID is held in an encrypted service.
Privacy and security
Understanding students means protecting them.
Information that helps you support a class better deserves special care. That is why we keep identity separate from learning context and limit how information is shared.
For school leadership, IT and data protection
IdentitySeparate, encrypted service · EUFirst and last name●●●●●● ●●●●●
Educational contextShared layerLiving ProfileEvidence and supportsPlans and adaptations
✓The real name never enters the shared layerLinked through an identifier
Architecture
Context is connected,
access is limited.
Isolate
One space per organization. Connecting a publisher or a school does not open access to anyone else's data.
Verify
A student's history is never joined on its own: a verified teacher has to approve it.
How we protect information
Four design decisions.
Identity
The name doesn't travel
with the learning data.
The real name is not stored in the shared layer. Its match to the identifier is held in an encrypted service hosted on European infrastructure.
Answers questions like:
- Where is the student's real name stored?
- What does the layer that links evidence and supports see?
- Is the data anonymized? No: it is pseudonymized.
IDIdentity serviceName ↔ identifier · encrypted · Google Cloud EUSeparate
084Shared layerProfile, evidence and supports, linked by IDNo name
AaAdapted materialDelivered to the authorized teacherReviewable
Isolation
Each school
in its own space.
Information is tied to each school's identifier. Connecting a publisher or a school does not open access to anyone else's data.
Answers questions like:
- Can a publisher see a school's data?
- Does connecting a platform open access to other customers?
- How is each organization's information kept separate?
ASchool AOnly its own data
BPublisher BOnly its own data
CSchool COnly its own data
Verification
Histories are never joined on their own.
Linking a student's history across publishers requires the approval of a verified teacher by email. It is never done automatically.
Answers questions like:
- Is history merged automatically across publishers?
- Who has to approve it?
- How is that person verified?
1History at publisher ASame studentSeparate
2History at publisher BSame studentSeparate
✓A verified teacher approves itVerification by emailLinked
Professional judgment
AI suggests, the professional decides.
The system suggests and generates supports; the professional reviews and validates the result. Curriculum decisions require teacher involvement, not an autonomous choice by the AI.
Answers questions like:
See the seven principles →- Does the AI make the final educational decision?
- Who validates each material before it is used?
- Who decides on a curriculum modification?
1Nubo suggests the adaptationWith the reason for each changeSuggestion
2The teacher reviews itCan edit it or discard itIn review
3And validates itOnly then can it be downloadedValidated
Providers
Trust is something you choose, too.
We rely on infrastructure providers with certifications and audits you can verify. Here you can see what each one provides and check the sources.
Backend services
With a shared information layer.
ISO 27001ISO 27701SOC 2 Type II
Our partner publishes these certifications and its SOC 2 audit report in its security information.
Service hosting
Including the separate identity service.
ISO/IEC 27001
The certification of its security management system includes Cloud Run and Firestore within the published scope.
These certifications belong to the providers and cover the scope they publish. They are not Nubo's own certifications and do not replace our responsibilities for data processing.
The name stays home.
We work with learning data, not names. Only an identifier travels in the shared layer; the real name lives separately, encrypted, and the link between the two is protected on its own with access control.
Review it with your teamIn the shared layerID 084never the real name: it lives separately, encryptedThe link to identity is protected separately, and only authorized people can access it.
Trust and evidence
What's behind every decision.
Frequently asked questions
Let's talk specifics.
Does using an ID mean the data is anonymous?
No. Identity is stored separately, but a link to the identifier exists. This is pseudonymized information, which still requires protection and access control.
Is all information processed in Europe?
The separate identity service and the Nubo-operated services listed here are hosted on EU infrastructure. That is not the same as saying all external processing happens in Europe: calls to AI services require a review of their terms and of the specific data flow.
Can one publisher see another publisher's data?
Data is separated by customer. Linking the history of the same student across publishers requires a verified teacher to step in; it is never done automatically.
Does the AI make the final educational decision?
No. The system suggests and generates supports; the professional reviews and validates the result. Curriculum decisions require teacher involvement, not an autonomous choice by the AI.
Where do I find retention, contracts and rights?
Ask the team for the terms that apply to your school or integration: data processing, retention, deletion and handling of data rights requests. This page explains the system; it does not replace contract documentation or a privacy policy. Contact the team.
Let's review it with your team.
Tell us what your school or platform needs to check: data flows, providers, access, or procurement documentation.