How Jeru Vantage protects student data and wellbeing

Who can see a student's results

By default, only the student can see their own assessment results and report. A parent, a counsellor, a school or sponsor administrator, or a member of our own team can open a named student's report only when both of these are true: they are linked to that student — as a parent, on a counsellor's caseload, or through the school's enrolment — and the student has granted them access at the level the reader needs. A student can see, at any time, exactly who they have granted access to their report, and remove anyone from that list; removal takes effect immediately.

There is one exception. A counsellor a school added or approved can see the assessment results and AI report of that school's students on their caseload without each student's permission, on the school's authority. It does not apply to a student who has said no to that counsellor. It covers the results and the report only: a student's documents, journal, CV and planner still need the student's permission, from every counsellor. Independent counsellors need the student's permission for everything, as before.

A school or sponsor administrator does not get to open an individual student's full report through this. What they see instead is completion status and school-wide numbers, with a student's name shown only where that student has granted the school full access; otherwise the roster shows "Student" and a partial account reference. A school administrator can authorise sharing with another adult on behalf of a parent for a student in their care, but not with the school itself.

How counsellors are vetted

A counsellor cannot open a named student's results until they have been vetted. A counsellor that a school adds or approves is vetted by that school, for that school's students only. Any other counsellor is vetted in one of two ways, recorded by a member of our team: a police check, or, where a police check isn't available, a check of their government ID, two professional references we contact, and a safeguarding declaration the counsellor signs.

Either way lasts three years. We remind the counsellor 60 and 30 days before it runs out, and from the day it lapses they cannot open students' results until they are vetted again. Counsellors already approved when this rule began were given 30 days to be vetted.

Age rules

Jeru Vantage is for students aged 13 and over. A sign-up from anyone younger is refused at registration, not merely hidden afterwards.

If a student wants to share their contact details with a university beyond the first, anonymous stage of interest, and the student is under 16, a linked parent must approve that sharing before it happens.

What our AI providers receive

We do not name our AI providers here: their contract terms, including confirmation that they do not train on what we send them, are still being finalised (see the last section). What matters more is exactly what leaves our servers. Three parts of the product send information to an outside AI service to write text for a student, and in every one of these calls the student's name is deliberately left out — an automated test checks for it — and the student is addressed only as "you".

• The career report sends grade, curriculum, GPA, test scores, English level, citizenship, preferred countries and universities, dream career, budget band, financial-aid need, and assessment scores. Some sections also send home city, state and country.
• The AI advisor chat sends the student's own messages and chat history, plus a short summary of their report and profile. Names are stripped from this too, including a counsellor's name if the student mentions one.
• Planner Buddy's study coach sends a student's own words from their weekly reflections, their goal and task titles, mood, energy, and study preferences. It runs on a smaller, cheaper model than the report or the chat, and every student has a monthly limit on these calls. Once a student reaches it, no more calls are made for the rest of that month and nothing further is sent.

Only one part of our codebase is allowed to call an AI vendor at all, and which vendor handles a given request is chosen by our server configuration — never by the person chatting, and never per request. Each call carries the instructions and the conversation and nothing else: no account id, no device information, and no flag asking the vendor to keep the input.

Where data is hosted, and who processes it

Student data is stored in one database, configured to run in Singapore, and the application itself runs on servers also configured for Singapore.

Uploaded documents — transcripts, test scores, identity documents, financial evidence, essays — are stored with a separate file service, private by default, and opened only through links that expire after two minutes. There is no public URL for a student's file.

A small number of other outside services are involved: one to send email (account messages, digests, safeguarding notices), one to process payments, one optional analytics tool that only loads in a visitor's browser after they say yes to it, and one error-monitoring service that never receives a student's name, IP address, or anything typed to the AI advisor.

How long we keep data, and how deletion works

• Assessment answers and reports: 3 years after the student leaves.
• Wellbeing check-ins, mood and journal entries: 12 months, rolling.
• Browsing activity recorded during a focus session: 90 days, rolling.
• AI advisor chat transcripts: 90 days.
• Uploaded documents and messages a student sent: 3 years after the student leaves.

These windows are enforced by an automated job that runs every night, and every run is logged with what it did.

If a school stops using Jeru Vantage, its students are told first, given a real date, and a way to ask to keep their own results. Nobody's results are deleted before they have been told, even if that takes longer than planned.

A student, or their parent, can ask for the account to be deleted entirely. Afterwards, the account is an empty shell with no name, email or password, and everything that belongs only to the student — answers, reports, journal, browsing history, planner data — is deleted. A few records that also belong to somebody else's own history (for instance, a message a counsellor already received) are stripped of the student's words rather than deleted outright, so the counsellor's record is not left broken. A short, specific list of what deletion cannot reach — for example, a copy already sitting in a routine backup — is available on request.

Staff access

Different levels of our own staff hold different permissions. For example, the ability to open a student's uploaded documents at all is limited to two of our three staff tiers, and every time it happens it is logged automatically, whoever does it.

Anyone with a staff, school, sponsor, university or counsellor account must set up a second sign-in step — a code from an authenticator app — before they can use it; a password alone is not enough. Students and parents are not required to, though they can turn it on for their own account. A staff sign-in expires after at most 7 days regardless of activity (30 on a device someone has chosen to trust), so a stolen sign-in session does not stay useful indefinitely.

Certain actions that are hard to undo need a second, different staff member's approval before they run: exporting or bulk-deleting student data, promoting someone to a senior admin role, resetting a staff member's second factor, or changing where a partner's money is sent. The person who asked cannot approve their own request. If no second person is available, the action waits 24 hours, and whoever it affects is emailed a way to stop it.

Safeguarding

If something a student says to the AI advisor, or a pattern in their wellbeing check-ins, suggests they may be at risk, the product does not try to counsel them. It tells the student plainly that a person has been told, and alerts a real adult: the student's own school counsellor if they have one, or our own team if they do not. For a student with a linked school counsellor, the alert goes straight to that counsellor, and the timing promise below is the school's to make, not ours.

That alert says only that something needs attention, and roughly what kind — never the student's actual words or check-in notes.

A student is always shown crisis-line numbers for their own country where we have checked them (17 countries today); everywhere else, they are shown two international directories rather than a guessed number.

When our safeguarding team's staffed hours are set, we promise a reply within 1 hour during those hours, and only during those hours. Outside them, or before hours have been set, a student is told plainly that nobody has seen their message yet, and is pointed to the crisis lines and their local emergency number. We do not say, or imply, that anyone is watching this around the clock.

Security basics

• Every page is served only over an encrypted connection; we tell browsers, with a Strict-Transport-Security header, never to fall back to an unencrypted one.
• Every table in our database has row-level security turned on, and the database roles that could otherwise read it directly, bypassing our own application, have had that access removed. Inside the application itself, which student's records a caller may open is decided by our own code, checked on every request.
• Sign-in, registration, and the endpoints that call an AI service are all rate-limited, so a single machine cannot hammer them.
• Uploaded files are private by default, as described above.

What's still being finalised

A few things are drafted but not yet final:

• Our data processing agreement for schools is written and with legal review, not yet signed by anyone. Available on request.
• Our data protection impact assessment is written and with legal review. Available on request.
• We do not yet have a public page showing current uptime. Ask us directly.
• Contract terms with the outside services named in "What our AI providers receive" and "Where data is hosted" above are still being finalised. Available on request, service by service.