Trust & Security

Wizzad

Your study material is yours. We never use it to train AI models, we encrypt it in transit and at rest, and you can delete your account yourself from Account settings, or ask us to export or delete it (support@wizzad.ai).

Last reviewed 2026-10-06.

No training on your data

We do not train Wizzad models on your content, and we never sell your data. Your notes, documents, transcripts, and chats are used only to provide the features you ask for.

When a feature needs a third-party AI model, the content it needs is sent to that provider under its API terms. The AI providers listed below state in those terms that API inputs and outputs are not used to train their models; the other providers listed, and what each receives, are named under subprocessors.

Compliance & certifications

SOC 2 Type IIRoadmap
Planned. No independent audit has started yet.
ISO/IEC 27001Roadmap
Information-security management certification planned to follow SOC 2.
ISO/IEC 42001 (AI management)Roadmap
Responsible-AI management system certification on the roadmap.
GDPRAligned
We honor data-subject rights and offer a Data Processing Agreement on request.
CCPA / CPRAAligned
California privacy rights (access, deletion, opt-out of sale — we never sell data) are honored.
FERPAAligned
For institutional use Wizzad acts as a "school official" only under a written agreement with the school, and processes education records only on its instructions.
COPPARoadmap
Wizzad is for people aged 13 and over (Terms). Use with children under 13 — through a school, with verifiable consent — is not supported yet.

Statuses are kept honest: we never mark a certification “Certified” until an independent audit is complete.

How we handle your data

Encryption in transit: TLS 1.2+ for all traffic between your browser, our servers, and every subprocessor.
Encryption at rest: AES-256 for data stored on our servers; the Brain memory index stays in your own browser (IndexedDB) unless you opt into cross-device sync.
Data residency: Primary processing and storage are in the United States. EU/regional data residency for institutional customers is on the roadmap.
Retention: We retain your content while your account is active. An account nobody signs in to for 24 months is deleted after an email warning and a 30-day window to keep it, unless it pays for a subscription or holds credits bought. When you delete your account, it is locked at once and nothing you shared opens for anyone; after a 14-day window in which you can keep it, it is erased — within 30 days of your request. Billing records are kept without your name, as the law requires. Backups roll off within 90 days.
Access control: Deny-by-default authentication gates every page and API at the edge with a cryptographically verified session; passkeys (WebAuthn), breached-password checks, and per-feature rate limits are live. Organization SSO (SAML), SCIM provisioning and an admin audit-log console are not available yet.

AI subprocessors

When a feature needs a third-party model, we send only what that feature requires, under terms that exclude training on your data.

Provider	Used for	Trains on your data
OpenAI	GPT-5.5 reasoning, embeddings for Brain memory, image generation. API inputs not used for training; retained ≤30 days for abuse monitoring, then deleted (zero-retention available for eligible workloads).	No
Anthropic	Claude models for Cowork and document analysis. API inputs not used for training; retained only as required to deliver the service and for safety.	No
TwelveLabs	Video understanding, transcripts, and moment search for Video Chat. Customer video and derived indexes processed to provide the feature; not used to train foundation models.	No
ElevenLabs	Voice synthesis and voice features. Audio processed to render the requested output; not used to train models under enterprise terms.	No

Infrastructure subprocessors

Render
Application hosting and compute.
United States
Cloudflare
Network edge and object storage (R2): uploads, project files and defense recordings.
Global edge; storage per bucket region
Google (Gemini API)
A third AI grader of explanations in a defense, and image generation; receives the answer or prompt it works on.
Per the provider’s terms
Runway and LiveKit
The spoken examiner in a defense, when the student chooses it: real-time voice and the examiner’s video.
Per the provider’s terms
E2B
Re-running a student’s notebook in a sandbox, when they ask.
Per the provider’s terms
Kling, Black Forest Labs and Serper
Video and image generation and web search, from the prompt you give.
Per the provider’s terms
Liveblocks
Real-time collaboration on shared documents.
Per the provider’s terms
DocuSeal
Electronic signature requests you send.
Per the provider’s terms
Chargebee
Subscription billing (with Stripe).
Per the provider’s terms
Managed PostgreSQL
Primary database (accounts, billing, persisted artifacts, vector index).
United States
Stripe
Payment processing and subscription billing.
United States
Resend
Transactional email (verification, password reset).
United States

Your data rights

Access
See what we hold about you and how it is used.
Export
Ask for a copy of your content and records (support@wizzad.ai); signed records and links can be downloaded from your account at any time.
Deletion
Delete your account yourself from Account settings (or ask us, support@wizzad.ai). You have 14 days to change your mind; then it is erased, within 30 days of your request.
Correction
Fix inaccurate account information.
Consent control
Brain memory is opt-in and can be paused or wiped at any time, with the consent record retained as the audit artifact.

Report a vulnerability

Found a security issue? Email security@wizzad.ai — we aim to respond within 72 hours. Our machine-readable disclosure policy is at /.well-known/security.txt.