Infrastructure & Data Storage

Technical information about VivaEdu's infrastructure, data storage architecture, and security measures. Designed for institutional IT teams, security officers, and data protection officers.

Hosting Infrastructure

AWS UK (eu-west-2, London)

VivaEdu is deployed per institution as a dedicated environment. Each institution receives a dedicated Lightsail instance (with database and cache), plus a dedicated S3 bucket for object storage.

Microsoft Azure UK South

Audio transcription is processed via Microsoft Azure Speech Services in the UK South region:

• Speech-to-Text: Student audio recordings transcribed to text
• Translation: Multilingual viva responses translated (when enabled by institution)
• Processing Location: UK South region only, no data leaves the UK

Microsoft Azure OpenAI UK South (Optional)

For institutions that enable branching questions, Azure OpenAI (UK South) provides follow-up question routing:

• Purpose: Select the appropriate follow-up question from teacher-authored candidates
• Input: Student transcript excerpt, teacher routing hints, candidate questions
• Output: Selection of an existing teacher-authored question (no new content generated)
• Processing Location: UK South region only
• Feature Status: Feature-flagged, enabled per institution

OpenAI Text-to-Speech (Question Reading Only)

• Purpose: Accessibility feature for reading questions aloud
• Input: Teacher-authored question text only
• Guardrails: API endpoint fetches question text by questionId from the database, does not accept arbitrary text
• Disabled Services: OpenAI translation is disabled (returns HTTP 410)

Data Storage Architecture

PostgreSQL Database

All structured data is stored in a PostgreSQL 15 database on the Lightsail instance:

• User accounts: Student and instructor profiles, authentication data
• Classes and enrollments: Course sections, student enrollments
• Assignments: Viva configurations, rubrics, due dates
• Sessions and responses: Student viva attempts, status tracking, text transcripts
• Grades and feedback: Teacher evaluations, rubric scores, feedback text
• LTI integration data: Platform configurations, context mappings
• Audit logs: Comprehensive logs of sensitive actions

Object Storage (AWS S3)

Large files are stored in S3 with structured key prefixes. Each institution has a dedicated bucket.

• Audio recordings: Student viva responses (.webm, .mp3)
• Video recordings: Student responses (when enabled), instructor video prompts
• Essay uploads: PDF and DOCX files submitted by students
• Question images: Images and diagrams used in viva questions
• Context cards: Reference materials (PDFs, images) students see during vivas
• Export archives: ZIP files generated for data exports

Data Isolation

Each institution operates in a fully isolated environment:

• Dedicated Lightsail instance: Separate compute, database, and cache per institution
• Dedicated S3 bucket: Media and files stored in institution-specific bucket
• No data commingling: Institutional data is never shared or mixed with other institutions
• Demo isolation: Demo environments use tenant IDs with automatic 2-hour expiration and complete data deletion

Security Measures

Encryption

Access Control

• Role-based access control (RBAC): STUDENT, TEACHER, TA, and ADMIN roles with authorization checks on every request
• Least privilege principle: Users can only access data relevant to their role and institutional relationships
• Class scoping: Teachers access only classes they created or teach; students access only classes they are enrolled in
• Signed URLs: S3 objects served via time-limited signed URLs (15 minutes to 7 days) with strict permissions

Application Security

• Authentication: JWT-based with secure refresh tokens, bcrypt password hashing
• Input validation: All API inputs validated using Zod schemas
• File upload restrictions: MIME type validation, size limits (100MB), content type enforcement
• Content Security Policy: CSP headers restrict embedding to trusted LMS domains only
• Rate limiting: Login attempts and file uploads are rate-limited
• XSS protection: React escaping and markdown sanitization

Subprocessors

The following third parties process personal data on behalf of institutions using VivaEdu:

AWS Certifications

AWS UK infrastructure (eu-west-2) holds the following certifications:

• ISO 27001: Information security management systems
• ISO 27017: Cloud-specific information security controls
• ISO 27018: Protection of personally identifiable information in public clouds
• SOC 2 Type II: Service organization control reports
• GDPR: AWS Data Processing Agreement and GDPR-compliant data handling

Backup & Recovery

Backup configuration for each institutional deployment is confirmed during onboarding. Contact your VivaEdu representative to verify backup status for your deployment.

Related Topics