Trust and security

What we promise.

Each of these is a commitment in our published Privacy Policy, not a slogan.

Never sold.

We do not sell your data, and we do not share it for advertising.

Nobody at Vidya reads your conversations.

A database level wall keeps conversation content out of our admin tools.

Encrypted, and kept to you.

Your data is encrypted in transit and at rest, and your conversations never train models for anyone else.

Professors see topics, not people.

Educators get topics and counts, shown only above a minimum group size. Your name appears only if you choose to share it.

Vidya asks first.

Before anything you share reaches an outside AI provider for the first time, Vidya asks. Say no and you keep the features that run on our own systems.

Yours to control.

See and change what Vidya remembers. Export or delete everything, and disconnect any source, whenever you like.

Security overview.

How the promises above are kept, in the words of our Privacy Policy.

Where it runs

Vidya is hosted in the United States. Our engineering team works from Hyderabad, India, and reaches production systems only under access controls, logging and confidentiality agreements.

Encryption

TLS 1.2 or higher in transit. AES-256 at rest.

Access

Production access requires multi factor authentication, is limited by role, and is logged and reviewed.

The privacy wall

Conversation content is separated from administrative tooling at the database level, so staff cannot read it.

Connected accounts

Google connections use Google's own sign in. Access tokens are stored encrypted, and disconnecting a service stops access immediately and deletes its token. Every connection can be removed from Settings.

Retention

Every kind of data has a published retention period, and deletion reaches backups too. The full schedule is in section 9 of the Privacy Policy.

Incidents

We test for vulnerabilities, patch promptly and keep an incident response plan. If a breach affects your personal information, we notify you and the relevant authorities as the law requires.

For universities.

When a school brings Vidya in, we work as a school official under its direction, and education records are used only as the school allows. Institution administrators are not given access to students' conversations, and if an agreement or the law ever required it, students would be told first.

Institutional Services AgreementThe contract between Vidya and your institution. On request
Data Processing AddendumHow we process personal data on your institution's behalf. On request
FERPA and Student Data Privacy AddendumOur obligations for education records under FERPA. On request
HECVATThe higher education security questionnaire, filled in once and shared with every school that asks. In preparation
VPATOur accessibility conformance report, measured against WCAG 2.1 AA. In preparation
Independent penetration testAn outside firm testing Vidya for weaknesses, with a summary for reviewers. In preparation
SOC 2An independent audit of our security controls. In preparation

Reviewing Vidya for your campus? Write to hello@vidya.co with "Security" in the subject line. We send what is ready and tell you where the rest stands.

Accessibility.

Our target is WCAG 2.1 Level AA across this site and the Vidya apps. Our formal conformance report is in preparation. What is in place today, here and in the app:

On this site, every control works by keyboard, with a visible focus outline.
Text on this site meets a 4.5:1 contrast ratio.
Every animation here has a still version, and reduced motion settings are honored.
In the app, every spoken answer comes with a transcript.
Talk, dictate or type: every question can be asked all three ways.
These pages open and read on machines without graphics acceleration, the kind schools often issue.

Hit a barrier? Email hello@vidya.co with "Accessibility" in the subject line. Tell us the page, what you were trying to do and the assistive technology you use, and we will help you finish the task another way while we fix it.

Every company that touches your data.

These are our subprocessors, the companies that process personal data on our behalf. Each is bound by contract to use it only to provide its service to Vidya. We update this list when it changes.

Company	What it does for Vidya	Data it handles
Vercel Inc.	Hosts this website and the Vidya web app	Requests to our servers and the data inside them as it passes through
Supabase Inc.	Database and file storage	Accounts, conversations, memory, uploaded files and settings
Railway Corporation	Runs Vidya's AI service	Messages and the context needed to answer them, while they are processed
Google LLC (Gemini API)	AI responses, voice transcription and speech	Your messages, relevant context from your memory and connected sources, files you attach, voice audio and text to be spoken
OpenAI (API)	Answers questions typed into the live demo on the Digital Twin page	The demo question only. Nothing from Vidya accounts, and Vidya does not store it
RunPod, Inc.	GPU servers for voice cloning	Voice samples and voice profiles, only with signed consent, and text to be spoken in a cloned voice
PostHog Inc.	Product analytics	Usage events such as page views and which features are used
Stripe, Inc.	Payments made outside the mobile apps	Billing details and transaction records. We never see full card numbers
Apple Inc.	Purchases in the iOS app	Purchase receipts
Google LLC (Google Play)	Purchases in the Android app	Purchase receipts
ID.me or SheerID	Verifies that educators teach where they say they do	Name, institution and verification status. We never receive identity documents
Namecheap, Inc.	Email to and from hello@vidya.co	Email addresses and message content

Report a problem.

One address, read by the people who build Vidya.

A security issue

Found a vulnerability? Tell us before anyone else, with enough detail to reproduce it.

Email Security

A privacy question

Want your data, want it gone, or want to know what we hold? Ask, or do it yourself in Settings.

Email Privacy

Trust, itemized.