Privacy and data protection
A detailed privacy policy covering data categories, purposes, and individual rights.
Security & Compliance
Security and compliance for education
The measures presented by Nabunam and the documents available to help prepare your assessment.
This documentary overview is neither an audit nor a certification. The measures and conditions applicable to your deployment remain to be confirmed with Nabunam.
Data protection and privacy
Nabunam is designed to make life easier for administrators, IT teams, and privacy officers conducting an evaluation.
Data protection by design
Non-essential settings are disabled by default and enabled only with consent.
Institutional governance
Documented internal policies and a designated privacy officer.
Incident readiness
An incident register and a notification procedure to authorities and affected individuals when required.
Secure data handling
Encryption in transit and at rest where relevant, with access controls proportionate to sensitivity.
Logging and monitoring
Logging of sensitive access and operational monitoring of service availability.
Compliance and legal frameworks
Nabunam is designed to help institutions evaluate privacy, security, and governance requirements before deployment.
- Law 25 (Quebec)
Our governance and privacy practices take Quebec's Law 25 requirements into account.
- PIPEDA (Canada)
Canada's federal private-sector privacy law informs our practices outside Quebec.
- GDPR and UK GDPR
Applicable EU and UK obligations for relevant users are documented in our privacy policy.
- CCPA / CPRA (California)
Applicable California consumer rights are also covered in our privacy policy.
- Accessibility
Our work aims to align with the CAN/ASC‑EN 301 549 ICT accessibility standard.
- Procurement readiness
Nabunam is preparing to meet Quebec and Canadian public and institutional procurement requirements.
Full jurisdiction-by-jurisdiction detail is available in the regional annexes of our privacy policy.
Access, roles and authentication
A careful overview of the technical and organizational measures in place, without disclosing details that could compromise security.
Authentication and role-based access
Platform access is structured by role (administration, teachers, students), with authentication required for any sensitive action.
Institution-aware architecture
Each institution keeps a distinct space within the platform.
Environment separation
Each institution's data and access remain separated from other environments.
This page provides a general overview. Additional technical details can be shared as part of an institutional review under a confidentiality agreement.
AI and content processing
Nabunam uses artificial intelligence as an assistance tool — never as a substitute for teachers' professional judgment.
Humans stay in control
AI proposes a starting point; the teacher decides, adjusts, and validates the final content.
AI governance
AI is used as an assistance tool, under human supervision, with documented usage rules.
Careful data handling
Content submitted for inference is not used for advertising purposes, nor reused to train models without an appropriate legal basis or contract.
Canada-first processing
AI features prioritize processing hosted in Canada whenever possible.
Hosting and vendors
Canada-first hosting
Core infrastructure is hosted in Quebec/Canada whenever possible.
Backups and operational safeguards
Regular backups and a documented incident response plan.
Vendor transparency
Categories of vendors and subprocessors are published and kept up to date.
Vendor and subprocessor transparency
Vendor categories, regions, and transfer mechanisms are published publicly.
Nabunam publishes the categories of vendors and subprocessors that may process personal information, along with their regions and transfer mechanisms.
The actual location and arrangements for each service must be confirmed for your deployment. The vendors page presents recipient categories and their qualifications.
Retention and deletion
The Privacy Policy describes retention, destruction and anonymization conditions, as well as individual rights.
Consult the applicable terms in the policy and your institution’s agreements; this page adds no retention period.
Documents and contact
Your institution can request several forms of support before a deployment.
- A platform demonstration
- A pilot project evaluation
- Answers for an IT review
- Privacy and governance documentation
- A direct discussion with our team
Frequently asked questions
Where is Nabunam hosted?
Nabunam's core infrastructure prioritizes hosting in Quebec/Canada. Service-by-service detail is published on our vendors page.
Does Nabunam support institutional privacy reviews?
Yes. Our privacy policy, governance practices, and vendor list are published to support a review by your IT team or privacy officer.
How does Nabunam handle AI-assisted workflows?
AI acts as an assistance tool under human supervision. Teachers retain pedagogical control and final validation of content.
Can our institution run a pilot before deployment?
Yes. Nabunam is designed to be evaluated at the scale of a cohort or department before a broader rollout.
Who should we contact for security questions?
You can reach our team through the contact page, or the privacy officer listed in our privacy policy.
Ready to evaluate Nabunam for your institution?
Let's discuss your security, privacy, and governance needs before any deployment.