Data Protection

Data ownership

Institutional content, records, and conversation history remain the property of the institution. Export and deletion paths are defined in the service agreement rather than left to the platform’s discretion.

Access control

Access is governed by role-based permissions, user authentication, single sign-on where the institution uses it, access policies, and administrative permission levels.

The permitted source set is resolved from the requester’s role before a response is generated, so content outside a user’s scope is not retrieved.

Auditability

The platform maintains conversation audit logs, integration activity logs, and knowledge source tracking, so an administrator can review which information was used to produce a given response and which systems were accessed.

Accountability for decisions

EASM does not decide admissions, finance, examination, or grading outcomes. It routes, retrieves, and evidences. Authority for those decisions remains with a named human owner in every deployment.

Hosting, retention, and recovery

Hosting model, data residency, retention controls, backup and recovery procedures, and monitoring are confirmed for each deployment against the institution’s security and regulatory requirements.