Trust Center
Built on transparency, designed for trust
Everything you need to know about how we protect your data, run our platform, and stay accountable to our customers.
Choose your region
Terms & agreements
Learn about the terms that govern your use of Kognity’s services.
How we handle your data
Our privacy commitments, data processing agreement, and full subprocessor list.
Security policies
An overview of the security policies and controls we operate. Full documents are available on request.
Responsible AI, by design
Our AI Governance policy defines how we design, deploy and monitor AI features - with safety, fairness, and human oversight at the core.
Designed to be usable by everyone
Accessibility is integral to how we build. Kognity follows universal design principles and WCAG 2.2 AA guidelines.
Independently verified
We maintain third-party certifications to demonstrate our commitment to security and responsible AI.
-
Subscription Agreement Terms (US)
The terms for purchasing our platform for customers in the United States. -
Subscription Agreement Terms (People's Republic of China)
The terms for purchasing our platform for customers in the People's Republic of China. -
Subscription Agreement Terms (Australia & New Zealand)
The terms for purchasing our platform for customers in Australia and New Zealand. -
Kognity Privacy Notice
In our Privacy Notice, we explain how we collect, use, and disclose personal data. -
US Customer Privacy Policy
In our US Customer Privacy Policy, we explain how we collect, use, and disclose personal information and data of users (K-12 students, educators, and other staff) at schools and school districts in the United States. -
Supplemental Privacy Statement for California Residents
Explains Kognity’s commitment to comply with California law and applies to personal information of California residents. -
Subprocessor List
We leverage the same subprocessors for all our subscribers; however, we keep two separate subprocessor lists: one for international subscribers and one for subscribers in the United States. -
Suprocessor List (US)
We leverage the same subprocessors for all our subscribers; however, we keep two separate subprocessor lists: one for international subscribers and one for subscribers in the United States. -
Recruitment Privacy Notice
In our Recruitment Privacy Notice, we explain how we process your personal data during the recruitment process. -
Cookie Policy
Our Cookie Policy explains how we use cookies and similar technologies on our website. -
Data Privacy White Paper
Explore our Data Privacy White Paper to learn more about Kognity’s commitment to safeguarding the personal data of our student and teacher users. -
Data Privacy White Paper (US)
Explore our Data Privacy White Papers to learn more about Kognity’s commitment to safeguarding the personal data of our student and teacher users. -
AI Safeguarding, Security and Privacy White Paper
Learn more about Kognity’s commitment to safeguarding the personal data of our student and teacher users. -
Information Security Overview
Our information security program follows standard frameworks like SOC2, ISO27001, and the NIST Cybersecurity Framework. If you would like to learn more about Kognity’s information security program, we invite you to read our Information Security Overview. -
Data Security and Privacy Plan
Our Data Security and Privacy Plans contain additional information about how Kognity safeguards personal data and ensures compliance with data security and privacy regulations and best practices. -
Data Security and Privacy Plan (US)
Our Data Security and Privacy Plans contain additional information about how Kognity safeguards personal data and ensures compliance with data security and privacy regulations and best practices. -
SOC2 Report
Kognity is SOC2 Type II certified. Our SOC2 Type II report is available on request subject to a customary non-disclosure underwriting. -
Accessibility Statement (Kognity Platform)
Our Accessibility Statement for the Kognity Platform details our commitment to conforming to applicable accessibility standards. -
Accessibility Conformance Report (VPAT)
Our Kognity Accessibility Conformance Report summarizes our current progress in meeting WCAG 2.2 Level AA accessibility standards, and is available on request. -
SOC2
Type II report covering security, availability, and confidentiality. -
ISO 42001 (in progress)
AI management system certification. -
Request certifications
Certification reports are available under NDA. Contact our data protection team to request copies.
No documents match your selection.
Common questions
Where is customer data stored?
Customer data is hosted on Amazon Web Services (AWS) and Salesforce Heroku infrastructure, providing enterprise-grade cloud security and reliability. Customer data is stored exclusively in data centers within the contiguous United States, under legally valid transfer mechanisms such as the Standard Contractual Clauses. Every subprocessor is thoroughly vetted for information security and privacy on a recurring annual basis, and production environments are fully isolated from testing and development environments, which never contain live customer data.
How long do you retain customer data?
Active customer data is retained for as long as the customer relationship continues, or until the customer requests deletion. Once a subscription ends, data is returned or destroyed, ensuring customers stay in full control of their data. Audit trail and security log data is kept for up to twelve months to support platform integrity and security monitoring, and secure disposal follows NIST SP 800-88 media sanitization standards, guaranteeing data is rendered fully unrecoverable.
How do you notify customers of a security incident?
Customers are kept informed through a structured, severity-based communication process, including direct email notifications, secure customer portal messaging, and status page updates. For incidents involving personal data, affected customers are notified without unreasonable delay and no later than 72 hours after discovery, with clear details on what happened, the data involved, and the steps being taken. Critical incidents trigger immediate internal escalation and hourly status updates until resolution, reflecting our commitment of transparency and rapid response.
Do you use subprocessors?
Yes. Trusted subprocessors support the delivery of our platform, and each one undergoes rigorous information security vetting before onboarding and at least annually thereafter. All subprocessor relationships are governed by contractual obligations requiring at least equivalent data protection standards, and an up-to-date subprocessor list is maintained and made available to customers.
Do you train AI models on student data?
No. Student or customer data is never used to train AI models.
Do you conduct security reviews and testing?
Yes. The platform undergoes weekly automated penetration testing alongside regular third-party vulnerability scanning, with formal penetration tests conducted at least annually and after any significant infrastructure or application change. Identified vulnerabilities are remediated on strict, severity-based timelines. Our security program is independently audited and verified through our SOC 2 Type II attestation report, which can be shared with customers upon request, subject to a non-disclosure agreement. Please reach out to dataprotection@kognity.com to request the report.
What's new
Updates from our legal team.
-
Changes to Subprocessor list
New subprocessor added – see Subprocessor list for details.
2026 -
ISO 42001 certification initiated
We initiated our ISO 42001 AI management system certification process.
2026 -
Privacy Notice updated
Clarified language on data retention and Kognity’s role.
2026 -
SOC 2 Type II report renewed
Annual SOC 2 Type II report is now available on request.
2026
Contact us
General legal questions: legal@kognity.com
Data privacy & information security: dataprotection@kognity.com
For general questions about Kognity’s offerings and services, please use our contact form.