Frequently asked questions

Customer data is processed only by the authorized subprocessors listed on the Subprocessors page, strictly for service delivery. Institutional data is never shared with third parties for training or marketing. All subprocessors operate under data processing agreements.

Yes. All data is encrypted at rest by default using Azure-managed encryption, and protected in transit with TLS 1.2 or higher.

CampusMind integrates with each institution’s own Microsoft Entra ID tenant. Sign-in from outside the institution’s tenant fails at authentication, and customer data is logically segregated per tenant.

Yes. All administrative access to the production Azure environment requires Microsoft Entra ID authentication with MFA enforced through conditional access policies.

Azure network security controls, Entra ID authentication in front of the application, Microsoft Defender across the environment, and automated security scanning.

Yes. CampusMind operates under Royal Cyber’s information security management system, including a maintained risk register, periodic risk assessments and management review.

Security events are monitored through Microsoft Defender and Sentinel. Incidents follow a documented procedure covering triage, containment, customer communication and post-incident review.

CampusMind is designed for US higher education and handles student education records in line with FERPA. A completed HECVAT assessment and VPAT report are available for institutional review.