Ora AI Data Privacy & Security

1Default Protections

Applies to every Ora user, on every tier.

We never train on your data

Ora does not use any user data (prompts, uploads, responses, behavior) to train, fine-tune, or improve any AI model. Ever. Your data powers the feature you're using in the moment and nothing else.

Our AI providers can't either

Ora's AI inference runs on Google Cloud Vertex AI (Gemini)by default. Under Google Cloud's terms for Vertex AI Generative AI services:

• Prompts, files, and responses are contractually prohibitedfrom being used to train or improve any Google or third-party model. (See Google's Vertex AI Generative AI Service-Specific Terms.)
• Ora's Vertex AI deployment is configured for zero data retention (ZDR). Google does not log, cache, or store prompt or response content beyond the immediate request lifecycle.

The underlying Google Cloud infrastructure operates under SOC 2 Type II, ISO 27001 / 27017 / 27018, HIPAA, and FedRAMP Moderate.

Encryption

• In transit: TLS 1.2+ on every connection.
• At rest: AES-256 encryption on all stored files by default.

You control your data

Users (and institutions on behalf of their users) can request deletion of any data at any time. Deletion is permanent, including from backups within our standard retention window.

What we don't do

We do not sell or license user data. Third parties that handle user data do so as subprocessors of Ora, under enterprise terms that prohibit them from using your data for any purpose other than providing the service, including model training. We do not run ads or use student data for advertising of any kind.

Independent audit

Ora is preparing for a SOC 2 Type IIaudit, with target completion in 2026. We're happy to share scope and roadmap details with your security team on request.

2FERPA Alignment

When Ora serves an institution:

• School Official Exception.We act as a "school official with a legitimate educational interest" under FERPA, using education records only to perform the institutional service you've engaged us for.
• No re-disclosure. We do not redisclose personally identifiable information from education records to any third party without authorization, except as required by law.
• Institutional control.Your institution retains ownership of, and control over, its students' education records inside Ora.
• Data Processing Addendum. Ora will execute a FERPA-aligned DPA, including the standard school-official, no-redisclosure, deletion, and audit-cooperation terms.

3Choice of AI Provider

Ora's default AI backend is Google Cloud Vertex AI (Gemini). For institutions with specific requirements, the inference backend is configurable under an institutional contract:

• Microsoft Azure OpenAI Service. Runs OpenAI models (GPT-4, GPT-5) inside Microsoft Azure (the same enterprise platform that powers Microsoft Copilot). For institutions standardized on Microsoft 365 / Entra.
  • No use of customer prompts, completions, or fine-tuning data to train Microsoft or OpenAI models.
  • Zero Data Retention.Microsoft does not log, cache, or store prompt or response content (Modified Abuse Monitoring enabled on Ora's Azure subscription).
  • HIPAA BAA included by default under the Microsoft Online Services Data Protection Addendum.
  • FedRAMP High authorized.
• Tinfoil (confidential computing). Hardware-attested secure enclaves. See §4, Option A.

All supported backends operate under enterprise no-training, no-retention terms.

6Contact