Third-Party and Integrations Policy
How approved integrations access Ilmiya and how responsibility follows the data.
If you build or manage an integration with Ilmiya, these rules explain how to connect safely and handle customer information. They govern your access when your accepted agreement with us includes this policy. An integrator can be a developer, an approved partner or another provider connecting a customer’s services. The governing agreement and Data Protection Addendum (DPA) control if they conflict with this policy on their respective subjects.
Different kinds of providers
| Relationship | What governs it |
|---|---|
| Ilmiya hires a provider to process customer personal data for the Services. | The DPA, Ilmiya’s contract with the provider and the Subprocessors List. Ilmiya remains responsible for its agreed subprocessor obligations. |
| A customer selects and contracts with a separate service and authorizes a connection. | The customer’s agreement with that provider governs the provider’s processing. Ilmiya remains responsible for its own handling and authorized transmission of the data. |
| A partner or developer enters a customer environment to provide a service. | Explicit customer authorization, the developer’s applicable agreement and any required processing terms must be in place before access. |
A third-party label alone does not decide a provider’s legal role. An AI provider used by Ilmiya to deliver a feature cannot be treated as the customer’s independent vendor merely because another company operates the model.
A customer-selected provider is responsible for its own service, terms, security and continued availability. Ilmiya does not endorse that provider or promise that a connection will remain available indefinitely. An integration may change or stop working when a provider changes its interface, terms or access. Ilmiya may modify or disable the affected connection where reasonably necessary; any express commitment in the Order and the DPA still applies to Ilmiya’s own work.
Authorized Access Only
An integrator must use an approved interface for the specific purpose the customer authorized. It must keep a record of the customer, permitted data, purpose, duration and people with access. A general program membership or a user’s possession of an account is insufficient authority to export an institution’s records.
The approved interface must be documented, and its use must follow the access requirements in the accepted agreement. The specific purpose the Customer authorized is the “Authorized Purpose” used below.
Use the minimum permissions needed. Do not bypass authentication, access another tenant, evade rate limits or scrape information outside approved access. A customer may authorize supported administrative access where it is needed; this does not permit sharing credentials or posing as another user. Access must stop when authorization ends or is withdrawn.
Access must also stop when authorization is reasonably disputed until the issue is resolved.
Data Minimization and Use Restrictions
Collect only what is necessary for the authorized purpose. Messages, voice recordings, transcripts, attachments, AI prompts and outputs receive the same protection as other personal information they contain.
An integrator must not sell customer or student data, use it for advertising or unrelated profiling, attempt to re-identify protected data, or combine records across customers without a lawful, expressly authorized purpose. A permitted export or migration must remain within that purpose and must not become an unrestricted copy of the customer’s database.
These restrictions also prohibit marketing and data brokerage. Replicating, bulk exporting, warehousing or maintaining substantially all of an institution’s records is permitted only to the extent necessary for the Authorized Purpose. Data from one institution must not be used to benefit another customer or third party outside a lawful, expressly authorized purpose.
An integrator must not use customer content to train or improve its own or a third-party model. Any future customer-specific model adaptation performed as an Ilmiya service needs separate written terms, the customer’s authorized choice, and any additional notice or permission required by law. A general API permission, school authorization or content license does not supply that approval. Third-party provider training remains prohibited.
The restriction includes fine-tuning and benchmarking its own or a third-party model with Customer Data.
A customer must be told what data will go to a connected service and why before enabling the connection. An integrator must not expand access or the purpose silently through an update. Unrelated student data must not be included in a prompt, diagnostic log or support ticket.
An integrator must not use Customer Data or Ilmiya’s confidential materials to build, train or operate a competing product outside the Authorized Purpose. This restriction preserves authorized exports and migration, lawful interoperability and independent development without misuse of those materials.
Credentials and Security
Protect data with appropriate access controls, encryption in transit and at rest, staff confidentiality and timely remediation of vulnerabilities. Keep credentials out of public code and revoke or rotate them promptly if compromised. Limit logs to what is needed, protect them and avoid unnecessary content or secrets.
Credential revocation or rotation must also occur promptly when compromise is reasonably suspected.
Personnel with access must receive security training appropriate to their work. Apply role-based and least-privilege access, monitor for misuse, and maintain the audit information needed to investigate access to Customer Data. Protect API keys, tokens and other secrets throughout their lifecycle.
Incident Notice
An integrator must notify support@ilmiya.com without undue delay and within 24 hours after discovering an actual or reasonably suspected incident affecting customer data, credentials or an Ilmiya-connected system. It must provide available facts, preserve relevant evidence, contain the incident and give updates as the investigation progresses. An initial report need not wait for complete findings.
Coordinate customer and public communications where lawful and practicable. Coordination cannot delay a required legal or contractual notice. Ilmiya’s own notice to a customer follows the DPA, rather than borrowing the integrator’s deadline.
Retention, Deletion, and Assurance
Disconnecting an integration normally stops future access; it does not prove that the other provider has deleted information already received. The customer and provider must address those copies under their contract and applicable law. Ilmiya cannot guarantee deletion from an independent customer-selected provider’s systems or recover data that provider lost.
An integrator must stop access when authorization ends and return or delete information as the governing processing terms require. It may retain a limited copy only for an applicable legal duty or another expressly authorized lawful purpose, with continued protection and no unrelated use. On reasonable request, it must provide evidence of compliance, such as a deletion confirmation or a relevant security-assessment summary.
Retention must be limited to the Authorized Purpose or an applicable legal requirement. Return or secure deletion must follow termination, revocation, or a valid instruction from the Customer or Ilmiya under the governing terms. On reasonable request, provide written confirmation of completed deletion and relevant independent security-assessment summaries where available.
Rate Limits, Suspension, and Revocation
Ilmiya may enforce reasonable rate limits or restrict an integration when necessary to protect data, comply with law, follow a customer’s instruction or address a material breach. Where safe and lawful, it will explain the issue and allow a reasonable opportunity to correct it. The restriction should be proportionate to the risk and removed when the reason is resolved.
Integrations must not place undue load on the Services. Ilmiya may monitor usage and throttle requests to enforce those reasonable limits.
Ilmiya’s Subprocessors
Ilmiya’s contracted providers, including providers used for enabled AI features, are identified in the Subprocessors and Service Providers register. Their processing remains subject to the DPA. This policy does not reduce Ilmiya’s responsibility for its own providers or permit a customer-selected integration to alter that processing chain.
Customer-Enabled Integrations
A Customer may connect supported services such as single sign-on, rostering or learning-tool integrations. It is responsible for its choice of an independent provider, the lawful instructions it gives and the provider agreement needed for that connection. That provider’s processing and continued availability follow its own agreement. Ilmiya remains responsible for its own components and authorized transmission of data under the Customer agreement and DPA.
Enforcement and Changes
A material violation of this policy is a material breach of the agreement that incorporates it. Remedies, suspension and termination follow that agreement and mandatory law. Where the governing agreement requires advance notice of a material policy change, including an applicable 30-day period, Ilmiya will provide that notice.
Changes follow the governing agreement. A revised webpage does not create a new data-use purpose or override an existing written customer or partner commitment. Questions can be sent to support@ilmiya.com.
This policy does not create a separate provider indemnity, guarantee of compatibility or uncapped liability. The indemnities, remedies and liability limits in the governing agreement apply, subject to mandatory law. An integrator remains responsible under its accepted agreement for its own access, representations and processing.