Security & data
How Folio looks after your school’s records
Written for the IT director, the data protection officer and the coordinator who has to answer their questions. If you need more detail for a review, write to us.
Where data is kept
Folio’s database and stored files are in Frankfurt, Germany (Supabase, in Amazon Web Services’ eu-central-1 region). The application runs in Frankfurt too (Vercel), beside the database.
Every file is kept in private storage. A file opens through a link that is made when someone with permission opens it and that stops working within 30 minutes. Uploads go straight from the browser into storage.
Each school kept apart
Folio serves many schools from one database. Every record belongs to one school, and the database itself enforces which school’s rows a person may read or change (row-level security, switched on and forced on every table). The separation does not depend on the application remembering to filter.
Every night, automated checks act as test users and confirm that the rules still hold, including that one school cannot see another’s records. A failed check emails us.
Who can sign in
- People sign in with their school Google account. Folio checks the account’s school domain with Google, not from what the browser claims.
- Signing in is not enough to get in. Only people your school has added to Folio are admitted; an account that is not on your list is turned away.
- Folio asks Google only for the person’s name, email address and profile picture. It does not read their email, files or calendar.
- An outside CAS supervisor (a coach, say) has no account. They get a one-off link for one student’s one experience, which stops working once used or after it expires.
- Microsoft sign-in is coming, for schools on Microsoft 365.
Who sees what
- A student sees her own record and nobody else’s.
- A teacher sees the students in the courses they teach. An EE supervisor sees only the students they supervise, unless an essay is shared with them.
- The IB coordinator sees the whole school, and can change anyone’s role and permissions at any time.
- Changes to released marks need a reason, and the change is recorded. Work handed in keeps its history.
Our access
PaperTrail Academic has no standing access to a school’s records through Folio. If we need to look at your school to help with a problem:
- we open a support view with a typed reason, for 1, 4 or 24 hours at most;
- the view is read-only, and some things are withheld from it entirely (personal codes, exports, the IB packs);
- your coordinators see a banner naming who opened it and why, and can end it early;
- opening and ending it are logged in a record that cannot be edited.
Photos, video and files
- Photos are re-encoded on the student’s device before upload, which removes location data.
- CAS video is converted on the device to a format every browser plays, without its location data. If a device cannot convert a video, the original is sent and the student is told it may keep its location.
- A student can remove her own CAS posts. A removed file is hidden at once and erased overnight.
Folio’s emails include a note to an EE supervisor when a student hands something in, one to a student when IA, EE or TOK work is returned, a weekly summary for the CAS teacher, and the CAS supervisor links. Emails carry names and a link into Folio, never the work itself or a teacher’s comments.
Ask Folio, the optional AI assistant
- It is off until your school switches it on, separately for staff and for students.
- It explains how to use Folio. It does not read student records and it does not help with the student’s work.
- Questions are answered by Anthropic’s Claude. A staff member’s question is sent with their name and role; a student’s is sent without her name.
- Anthropic does not train its models on these questions under its commercial terms.
- Each person can read their own questions. They are kept for one year, then deleted.
Copies, backups and leaving
- Export at any time: one student’s records and files, or the whole school’s, as ordinary files (CSV and the original documents). Whole-school download links stop working after 7 days and the files are deleted after 14.
- The weekly Drive copy (optional): once a week, every file, form and mark is copied into a Google Shared Drive your school owns, using a Google service account set up for your school alone. The copy lives in your Drive, under your control, whether or not Folio is still running.
- Backups: the database is backed up daily and backups are kept for 7 days. Stored files are not part of those backups, which is one reason the Drive copy exists.
- If your school leaves Folio, you take a full export first, and we then delete your school’s records and files.
Services Folio uses
These companies process data on our behalf to run Folio:
| Service | What it does | Where |
|---|---|---|
| Supabase | Database, file storage and sign-in | Frankfurt, Germany |
| Vercel | Runs the application | Frankfurt, Germany; pages are delivered from the server nearest the reader |
| Sign-in; the weekly Drive copy, if your school uses it | Google’s infrastructure; the copy is in your school’s own Drive | |
| Resend | Sends Folio’s emails | United States |
| GitHub | Runs the scheduled jobs that make the Drive copy and whole-school exports; data passes through in transit | United States |
| Anthropic | Answers Ask Folio questions, only if your school switches it on | United States |
We do not use analytics, advertising or tracking services.
The agreement
Folio is offered with a data processing agreement. Your school is the controller of its data; PaperTrail Academic is the processor and acts only on the school’s instructions. The agreement names the region, the services above, how long data is kept, how we tell you about a breach, and what happens when the subscription ends.
See also the Folio privacy policy and the Folio terms.