Trust
Where your data lives, and who sees it. Via holds the records of minors. Here is what we do with them.
In plain words, with the laws that apply, who else touches the data and whom to ask. Written for the partner who approves Via, the procurement office of a district and the parent who wants to know.
Where the data lives
In Microsoft Azure, in a data center in the EU, run by a Swiss company. Encrypted in transit and at rest. The backups stay in the same region, and no copy leaves it for analytics, training or anything else.
Who sees what
A counselor sees their own students. An admin sees the firm. A student sees what the counselor shares with them; a guardian sees their child and nothing else. Roles are set by the firm, never by Via.
Every change has an author
A note, a task, a step, a test result and a time entry carry who did what and when. An email address is changed by its owner alone, confirmed from the new address, and can be undone from the old one.
The agreements
A data processing agreement in which your firm is the controller and Via the processor, with the sub-processors named below. A school signs the student-data agreement its district uses. Swiss and EU law set the floor; the documents speak to US buyers too.
Access
Login by email and password: at least eight characters with a lowercase and an uppercase letter, a digit and a symbol. Invitations only, so nobody signs up by themselves, and a firm removes a person the day they leave.
Error reports without people
When something breaks in a counselor’s browser, Via records the page by its pattern and the request by its route, never a name, an email address, an id, a query or a body. Via holds minors’ data, so a report may not.
The laws
What applies. And what does not.
- Swiss FADP and the EU GDPR
- The floor for every tenant, wherever the firm is: a purpose for every field, no more data than the purpose needs, and the rights the law gives a person over their data.
- COPPA
- Students on Via are over 13, so COPPA does not apply. A younger student is not invited.
- FERPA
- Binds schools, not independent firms. Where a school is the customer, Via signs the student-data agreement its district uses, and the school stays the owner of its records.
- State privacy laws
- California and the states that followed: the same rights as above, honoured for every tenant, not only where the law reaches.
Sub-processors
Who else touches the data. Four names, and what each does.
| Who | For what | Where |
|---|---|---|
| Microsoft Azure | Hosting, the database, the files, the backups | EU |
| Google Firebase Authentication | The login: the email address and the password | Google, under its terms |
| Microsoft 365 | Sending Via’s emails | EU |
| Plausible | This site’s visits, without cookies; nothing in the app | EU |
Day to day
What happens with the data while you work. Email, the backups, and who at Via looks.
Via sends its own invitations, resets and the Monday email from no-reply@via.college; nothing is sent by a third party in Via’s name. An address that bounces is marked, so the firm sees it.
Backups
Azure’s standard backups, in the EU, in the same region as the data. No copy leaves it, and no backup is read for anything but restoring the service.
Who at Via opens a tenant
Nobody, unless the firm asks for help with a case. Then one named person opens it, for that case, and the access is logged. Via’s operators see no student record in their daily work.
The documents
What you sign, and whom to ask. Three documents, one address.
The privacy policy says what Via does with the data, the terms say what the contract is, and the data processing agreement comes with the contract for your firm to sign. Questions about any of this go to the people who build Via.
See Via with your own students in it.
A 30-minute demo in your afternoon, then a 60-day pilot with your data imported. No card, nothing to install.