Security & Compliance
Enterprise-grade security by design.
Campus AI is architected to meet the security, governance, and compliance requirements of Australian higher education. Every control is documented here — what is available today, what is on the roadmap, and how it maps to university obligations.
Authentication & Identity
- Authentication via Clerk with support for Azure AD/Entra ID SSO
- Multi-factor authentication (MFA) available via Azure AD (roadmap for native MFA, Q4 2026)
- Role-based access control: Student, Academic (staff), and Admin roles with granular permissions
- SCIM provisioning for automated user lifecycle management (roadmap, Q1 2027)
Encryption
- Data encrypted at rest using AES-256 via Supabase/AWS infrastructure
- Data encrypted in transit using TLS 1.3
- Encryption keys managed by cloud infrastructure provider (AWS KMS)
- No client-side encryption currently — available on roadmap (Q2 2027)
AI Guardrails
- Input pre-filtering: prompts are scanned for prohibited content before reaching the AI model
- Output post-filtering: AI responses are checked against academic integrity and content policies
- Human-in-the-loop review: staff can review, edit, and approve AI-generated feedback before release
- Configurable guardrail policies per unit, per agent, or per activity type
Audit Logging
- Immutable audit logs capturing all AI interactions (prompts, outputs, model, parameters)
- 7-year log retention to meet university record-keeping requirements (per Public Records Act)
- Event types: login, resource access, assignment submission, feedback generation, AI feature usage
- Log export via API or admin dashboard; structured JSON format for SIEM ingestion
Rate Limiting & Usage Metering
- Per-user and per-unit rate limiting to prevent abuse and ensure fair resource allocation
- Usage metering by feature (chat, flashcards, quizzes, simulations, feedback generation)
- Token-level tracking: input/output token counts per AI interaction
- Admin dashboard with real-time usage metrics and exportable reports
Infrastructure Security
- Application hosted on Vercel (SOC 2 compliant) with AU-region edge network
- Database hosted in AWS Sydney (ap-southeast-2) via Supabase
- AI inference via Google Cloud australia-southeast1 region
- Penetration testing: not yet conducted — scheduled for Q4 2026 ahead of general availability
Compliance Roadmap
We are actively working toward the following certifications and assurance frameworks to meet university procurement requirements.
ISO 27001
Information Security Management
SOC 2 Type II
Security, Availability, Confidentiality
IRAP Assessment
Australian Government security assessment
Penetration Testing
Independent third-party assessment