Security & privacy
Your students’ data, handled with care
A school holds children’s details, contracts and payments, and families trust you with all of it. Amber is built so that each person sees only what their role allows, every important change leaves a trace, and the AI receives only what a task needs.
Access
Two-factor login
Log in with a code from an authenticator app. A session lasts 24 hours at most, and there’s no "keep me logged in" box.
Roles down to the button
Decide per area who can see, open, add, edit or delete, and who gets special actions like exporting to Excel. Ranks stop anyone granting more than they have.
Students see only themselves
Parents see their own children and nobody else. Other families’ contacts stay hidden, even in group messages.
Traceability
Permanent change log
Automatic profile changes, online applications applied or dismissed, imports and every flag change go into a log that nobody can edit.
Evidence on signed documents
Every signed PDF records the typed name, the time, the logged-in person if there was one, and a fingerprint of the exact document.
Invoices that can’t be rewritten
Once fiscalized, an invoice can’t be edited or deleted, and invoice numbers are never reused.
Privacy
Consent where it belongs
Every profile has GDPR basic and marketing consent, and your online forms ask for privacy and marketing consent.
AI with blinkers
Ask Amber can’t see school data and lesson-plan AI never sees students. Reports send the AI numbers only, and support screenshots never reach the AI at all.
Support without exposure
Before a screenshot goes to support, you can black out any personal data on it.
Where Amber runs
Amber runs on Microsoft Azure in the Germany West Central region (Frankfurt), with automatic database backups. Uploaded files are stored in the same region and backed up daily. Card payments are processed by Stripe in the school’s own account, so Amber never holds the money.
Need a data processing agreement, or does your data protection officer have questions? Write to finances@amber-it.co.
Questions schools ask
Is Amber GDPR compliant?
Amber gives you the tools GDPR asks for: consent fields, role-based access, traceable changes and limited AI access. Your school remains the data controller, and Amber IT Solutions processes data on your behalf. Just ask us for the data processing agreement.
Is our data used to train AI?
Amber uses Claude through Anthropic’s commercial API. Under Anthropic’s commercial terms, data sent through the API is not used to train its models by default.
See your own school in Amber.
Give us 30 minutes. You tell us how your school works, and we show you what your day would look like in Amber.