School & Institutional Compliance
DanskAI meets GDPR and UK GDPR requirements out of the box. Data Processing Agreements, audit trails, and student data rights are all supported - so your procurement team can say yes with confidence.
GDPR & UK GDPR
Student data processed lawfully. Full data-subject rights. DPA available.
Stripe PCI DSS
No card data touches our servers. All payments via Stripe Level 1 PCI DSS.
AI transparency
No names or emails sent to AI providers. OpenAI does not train on your data.
Institution licensing
Per-seat billing, teacher dashboards, CEFR tracking, and commune enrolment.
Reporting a vulnerability
We take the security of DanskAI and our learners' data seriously. If you believe you've found a security issue, please report it to security@danskai.co.uk before disclosing it publicly.
Please include
- A clear description of the issue and its potential impact.
- Steps to reproduce, including any proof-of-concept code or URLs.
- Your name or handle if you'd like to be credited.
Our commitment
- We acknowledge reports within 3 working days.
- We aim to triage and respond with next steps within 7 working days.
- We will keep you informed as we investigate and remediate.
- We will not pursue legal action against good-faith researchers acting within this policy.
Out of scope
- Denial-of-service, brute-force, or volumetric attacks.
- Findings on third-party services we depend on (please report to them directly).
- Reports based purely on missing best-practice headers without demonstrated impact.
Machine-readable policy: /.well-known/security.txt