Nurture Signal is assessed separately from the rest of Nurture, so it has its own security page. It is written for whoever reviews Signal before staff and students get access — a director of ICT, a data protection officer or a vendor assessor.
For Australian schools. Signal runs on a dedicated deployment at
au.gonurture.com. All its data is stored in Microsoft Azure in Australia,
and AI generation runs in Australia too. A small number of paths reach a
provider outside Australia; each is listed in where data
goes, with its control or status.
What Signal is
A teacher (the host) runs a session. Participants join on their own devices with a six-character code and respond — answers, polls, reflections, comments and reactions. The host sees responses live and reviews the session afterwards.
- Standalone by default. No learning management system is involved, and Signal holds no gradebook or student file.
- Canvas, optionally. Your Canvas administrator can install Signal as an LTI 1.3 tool. It then receives each user’s identity and course role when they open it, and writes the score for its own assignment back to your gradebook. See Signal in Canvas.
- Not in Microsoft Teams yet. Signal runs in the browser and, optionally, in Canvas. It is not currently available as a Teams app.
What it holds
What Signal holds
- Accounts: name, email address, school, the identity provider’s account ID and profile picture.
- People without accounts: a guest’s display name, or the name and optional email a teacher enters for a shared-screen roster.
- What teachers write: session and question text, answer options and explanations, success criteria, model answers and the prompts they give the AI.
- What participants submit: every response type, including comments, replies and reflections.
- Results: correctness, scores and marks, guess or low-effort flags, AI feedback, and two behavioural signals — leaving the session view, and typed versus pasted answers.
- Class groups, which persist across sessions.
- With Canvas: the launch identity and course role, course membership of those who open Signal, the course’s assignment list, and the scores Signal writes back.
- Technical data: sign-in events, device and browser, IP address, logs and approximate location.
What it does not collect
- Your gradebook. With Canvas it writes its own score back but reads no existing grades.
- Other school records, such as student files. Beyond the Canvas items above, it reads none.
- Audio, video or file uploads from participants.
- Passwords — sign-in is passwordless.
- Sensitive information by design: no field asks for it.
Free text is not filtered. Anything a person types, and any curriculum document a teacher uploads for AI grounding, is stored as written — so sensitive information can arrive that way. The controls are practical: brief staff to keep student details out of session content and uploads, switch comments, questions or replies off per session where needed (comments are private to the host by default), or leave grounding off. Deleting an upload stops it being used; full erasure is made through a deletion request.
Where data goes
All Signal data is stored in Microsoft Azure in Australia: the database, file storage and curriculum indexes. Nurture runs the database itself rather than using a separate database service, and AI generation uses Azure OpenAI in Australia East. The application runs on Azure or, for some cloud deployments, on Vercel, which stores no account records or session content. A school can also run Signal entirely in its own Azure tenancy.
These paths reach a provider or person outside Australia. The DPIA pack sets each one out in full.
| Path | What reaches outside Australia | Control |
|---|---|---|
| Application hosting on Vercel | Where your deployment’s application runs on Vercel, requests and the pages they return pass through Vercel, and Vercel’s web analytics records page views (page, referrer, browser, device and country) without cookies or an account ID. Data stays stored in Azure in Australia | We confirm your deployment’s hosting in writing |
| Your Canvas instance | Where installed, the scores and assignment updates Signal writes go to your Canvas, wherever your school hosts it | Your Canvas hosting region; check it if it is outside Australia |
| Email sign-in codes | The recipient’s email address and the one-time code, via our email provider | We pin sign-in to your directory. That also stops the account-link code a teacher’s first Canvas launch would otherwise email |
| Sign-in with Google | Name, email, account ID and profile picture, to Google | Use Microsoft Entra, which signs in against your own tenant |
A teacher’s connected AI assistant, or other tools users connect | The session data that teacher can see, to a vendor they chose, under that vendor’s terms. Includes names, emails and profile pictures unless redacted | Switch the capability off for your school. Redaction removes names, emails and pictures, but the content still leaves |
| Error monitoring | Diagnostics with no identity, plus masked session replays (one in ten sessions, and every session with an error) that record clicks and navigation | Cannot be switched off per school |
| Product analytics | Usage activity against a pseudonymous account ID, never a name or email | Only where configured; we can switch it off |
| Nurture staff access | Remote access from Ireland for support, monitoring and security, debugging and maintenance, incident response, reporting, service administration and legal or compliance obligations. Data stays stored in Australia | Under contractual and technical controls |
If your requirement is that no one outside Australia can see student data at all, say so early. That is a different question from where data is hosted.
Your web filter needs the full Australian block from allowlisting URLs, on both staff and student policies.
How AI is used
- What it does: drafts sessions and questions, explains answers, summarises sessions, marks written answers and flags likely guesses. Marking and flags are aids — the teacher decides.
- Where it runs: Azure OpenAI in Australia East.
- What it receives: the text the feature works on. That includes anything a teacher writes (even a model answer hidden from students) and anything participants submit.
- Names: never sent as a field. A name typed into text travels with that text.
- Training: the providers Signal uses do not train on school data. That cannot cover a teacher’s own connected assistant, which follows its vendor’s terms.
Our general Australian privacy policy covers Nurture Assessments, which sends a student’s first name to its AI. Signal does not, and Signal’s own privacy policy is the one that governs Signal, including its optional Canvas integration.
Who can see what
- Teachers see their own sessions, and a colleague’s only when that colleague makes them a co-host or they join as a participant.
- Students see their own responses and whatever the teacher shows the room.
- Your school can restrict joining to your email domains, turn off guest joining, and control teachers’ connected AI assistants. Teachers cannot override these.
- Your Microsoft tenant is asked for
openid,profile,email,User.Read(the user’s own profile, for their photo) andoffline_access— no mail, files, calendar, directory or write access.
Security controls
- Encryption in transit (TLS 1.3) and at rest (AES-256).
- Passwordless sign-in and single sign-on with your directory.
- Least-privilege access, enforced in the database as well as the application.
- Error monitoring with personal data off and session replays masked.
- Logging, monitoring, patch management, secure development, incident response and disaster recovery plans.
Retention and deletion
Account and session data are kept while needed to provide the service, and technical logs for a limited period. Under our DPA (section 10) we delete or de-identify requested data within 30 days of a verified request, and delete or return your data within 30 days of the agreement ending, subject to legal, security, audit and backup exceptions.
Certifications
Nurture holds the Safer Technologies 4 Schools (ST4S) 2022.1 badge. The newer framework’s AI module did not yet cover products like ours, so we remain in the pool for reassessment. We hold no other formal security certification; our infrastructure providers operate SOC 2 Type II and ISO 27001 aligned environments, and we publish our policies in full instead.
Documents for your review
Sub-processor register
Every provider involved in Signal’s Australian deployment, what it receives and where it sits.
Read the registerSignal Privacy Policy
The policy governing Signal, including its Canvas integration, aligned to the Australian Privacy Act.
Read the policySecurity policy library
Information security, incident response, disaster recovery and more.
Open the libraryCommon questions
Is our data stored in Australia? +
Yes. For au.gonurture.com, the database, file storage and curriculum indexes are in Microsoft Azure in Australia, and AI generation runs in Australia. The application itself runs on Azure or, for some cloud deployments, on Vercel, which stores no account records or session content; we confirm which for yours. The few paths that reach a provider outside Australia are listed under “Where data goes” above.
Does the AI see student names? +
Not as a field. The AI receives the text a feature works on, so a name someone typed into an answer, comment or teacher-written content goes with it. A teacher’s connected AI assistant is different: it receives names unless your school requires redaction.
Is our data used to train AI models? +
Not by the providers Signal uses. A teacher’s own connected assistant follows its vendor’s terms, so switch that capability off or assess the vendors your teachers use.
Can we stop people outside the school joining? +
Yes. We can restrict joining to your email domains and turn off guest joining. Both are enforced when someone joins, and teachers cannot override them.
Will you sign our Data Protection Agreement? +
Yes — yours or ours at /legal/gdpr, whose processing details (Appendix 1) cover Signal. Its Australian residency clause (section 12) commits to storing your data in Australia and names the exceptions listed on this page. The DPIA pack sets out the detail.
Who is our contact for security questions? +
Daniel Paul, Information Security Manager — daniel@gonurture.com.