Security and privacy
The security of your data is our top priority.
An infrastructure built to protect you
Hosted in Paris
The database and the application are hosted in Paris. The site is only reachable over an encrypted connection (HTTPS).
Encryption and access
The database is encrypted at rest by our host. Access tokens for the services you connect, such as Google Calendar or Outlook, are additionally encrypted by the application itself, with a key separate from the database. Each account owns its data. Access is strictly controlled, with two layers of isolation: in the application and in the database itself.
Passwordless sign-in
Nothing to remember or to leak: you sign in with a single-use link sent by email, or with Google. Teachers can turn on two-factor authentication; teachers and students can use passkeys.
Payments handled by Stripe
Payments are processed by Stripe: ProfBloom never sees a full bank card number and the money does not pass through the application.
Your data stays under your control
Your GDPR rights
ProfBloom is a French company, subject to the GDPR. You can view, edit, export and delete your data from your account. A closed account is erased within 30 days.
Trusted providers
Nine providers are involved: database, hosting, email, payments, AI, calendar, error monitoring, support, usage analytics. Each is bound by a data processing agreement. ProfBloom's data is stored in Europe. Your Google or Microsoft calendar, if you connect it, stays with Google or Microsoft in the United States. The full list, with each provider's location, is in our privacy policy.
Nothing without your consent
Usage analytics are only enabled if you accept them, and you can change your mind at any time. Our team only accesses the content of your data to keep the application working properly, for example to answer a support request and fix a bug.
An AI that respects your data
Controlled use
AI is used for specific features, for example generating exercises or assessing a piece of writing. It relies on Mistral AI, a French company, with data processed in Europe. Mistral AI keeps each request for at most 30 days, for abuse monitoring, then deletes it.
Students stay anonymous
The AI never receives a student's identity. Only the educational information you or your student choose to submit is transmitted, such as the level, the type of exercise, the topic or a piece of writing.
No training on your content
The teaching content you import or create is never used to train a model. Only generation requests and students' work, anonymised, may contribute to it. To date, ProfBloom does not train any model of its own.