Built for student data from the first line.
Peridot holds what students do and how they did. We treat that as sensitive: isolated per organisation, kept out of AI models, and logged. This page says what is in place today and what is not yet.
One organisation, one space.
A university’s students, courses and results never sit alongside another organisation’s. Each organisation has its own keys for the API and sets its own AI limits.
- People
- Courses
- Results
- Tutor history
- Keys, AI limits
- People
- Courses
- Results
- Tutor history
- Keys, AI limits
Personal data stays private.
Students can ask the tutor anything about the lab. Their names, emails and student IDs stay with Peridot, the tutor never gives the answer away, and your organisation sets the AI limits.
Private by default
Personal details stay with Peridot.
Visible to staff
Course teams can read what the tutor said, and why.
Not for training
Our policy: students’ work is not used to train AI models.
What is in place, and what is not yet.
Status is current as of November 2026. We update this table rather than the marketing.
| Control | What it means | Status |
|---|---|---|
| Organisation isolation | Every record carries its organisation; queries are scoped to it at the data layer. | In progress |
| Role-based access | Org admin, unit admin, lecturer, TA and student, scoped to units and courses. | In progress |
| Personal data stays private | Names, emails, phone numbers and student IDs stay with Peridot when students use the AI tutor. | In progress |
| Tutor history for staff | Course teams can read what the tutor said to their students. | In progress |
| Audit log | Sign-ins, role changes, mark changes and exports, kept per organisation. | In progress |
| Encryption in transit | HTTPS everywhere, including webhooks. | In progress |
| Signed webhooks | Each delivery signed so your systems can verify it came from Peridot. | In progress |
| SSO with SAML 2.0 / OIDC | Sign in with your identity provider. | Coming |
| SCIM provisioning | Users and groups from your directory. | Coming |
| Choice of data region | Hosting region chosen per organisation. | Planned |
| Independent audit (e.g. SOC 2, ISO 27001) | Not started. We will say so here when it is. | Planned |
Our stance
We want institutions to choose where their data lives. Until a region choice is available, we tell every pilot partner exactly where their data is hosted and by whom, in writing, before any student signs in.
A computer in the cloud each
Each student has their own computer in the cloud. A destructive command breaks only their own cloud computer, and a reset takes one click.
Export and delete
Organisations can export their results, and ask for their data to be deleted when they leave.
Asked by ICT and data protection teams.
Do you have SOC 2 or ISO 27001?
No, not yet, and we have not started an audit. We will not claim one until it is done.
Can we sign in with our identity provider?
Not yet. SAML and OIDC single sign-on and SCIM provisioning are on the roadmap. Today, students join by invitation link or roster upload.
Does the AI tutor see personal data?
No. Names, emails and student IDs stay private. The tutor sees the question and the lab step it is about.
Will you sign a data processing agreement?
Yes. Pilot partners get a data processing agreement before students sign in.
Questions from your security team are welcome.
We would rather answer them before a pilot than after.