Data Security and Privacy

Our Commitment

ReportRocket is built by Australians, for Australian schools. We take student data privacy extremely seriously.

Australian Data Hosting

Everything ReportRocket stores is kept in Australia (AWS Sydney region).

Why This Matters

• Designed to comply with Australian privacy law
• Subject to Australian jurisdiction
• Faster performance for Australian users

Encryption

In Transit

All connections use TLS 1.2 or higher, the same encryption banks use.

At Rest

Stored data is encrypted using AES-256, the government-grade encryption standard.

Access Control

Row Level Security (RLS)

Every database query is filtered to ensure:

• Teachers only see their own students
• Schools only see their own data
• Reviewers only see assigned packs
• No cross-account data leakage

Authentication

• Email-based sign-in with verification
• Secure session management

What We Don't Do

❌ Share student data with anyone except the services that run ReportRocket (listed in our Privacy Policy)

❌ Use student data for AI training

❌ Sell any user data

❌ Send student names to the AI (we swap them for stand-in names first)

❌ Look at your data for anything other than running the service

Comment Generation Processing

When you generate or check comments:

• Student names, other students' names and your school's name are replaced with stand-in names before anything is sent
• Requests go to Google Gemini (Google AI API), or Google Cloud's Vertex AI if Gemini is busy
• Google does not use what we send to train its models
• Google keeps a copy for a limited period to detect misuse, and may store it briefly outside Australia

See How ReportRocket uses AI with student data for the details.

Admin Access

ReportRocket staff look at account data only to run the service: to give support, fix problems, keep it secure and understand how it's used.

School Admin Access

For school licences:

• School admins have full access to classes, teachers, and student report comments across the school
• Admins can generate and edit comments for quality assurance and oversight
• All admin actions are logged in the Activity tab for accountability

Data Retention

• Active accounts: Data stored indefinitely
• Deleted accounts: Data permanently removed. Backup copies are kept for a limited time and then removed
• Inactive accounts: No automatic deletion

Compliance

We follow the Australian Privacy Principles (APPs) in the Privacy Act 1988.

Incident Response

In the unlikely event of a data incident:

1. Immediate containment
2. If a breach could cause serious harm, we tell the people affected and the Office of the Australian Information Commissioner as soon as practicable, following the Notifiable Data Breaches scheme
3. Full investigation and remediation
4. Transparent communication

Questions?

Have specific privacy questions? Contact us. We're happy to discuss your school's requirements.

Next Steps

• Deleting your account
• Understanding your subscription