Ora AI Data Privacy & Security

1Default Protections

Applies to every Ora user, on every tier.

We never train on your data

Ora does not use any user data (prompts, uploads, responses, behavior) to train, fine-tune, or improve any AI model. Ever. Your data powers the feature you're using in the moment and nothing else.

Our AI providers can't either

Ora's AI inference runs on Microsoft Azure OpenAI Service. Under Microsoft's data-privacy terms for Azure OpenAI:

• Prompts, files, and responses are contractually prohibited from being used to train or improve any Microsoft, OpenAI, or third-party model. (See Microsoft's Azure OpenAI data, privacy, and security terms.)
• Ora's Azure OpenAI deployment is configured for zero data retention: response storage is turned off on every request, so prompts and responses are processed in memory and not retained. Microsoft's abuse-monitoring safeguards evaluate content in real time and store a sample only if a request is flagged as potentially abusive; any such sample stays encrypted in Ora's Azure geography and is never used for training.

The underlying Microsoft Azure infrastructure operates under SOC 2 Type II, ISO 27001 / 27017 / 27018, HIPAA, and FedRAMP High.

Encryption

• In transit: TLS 1.2+ on every connection.
• At rest: AES-256 encryption on all stored files by default.

You control your data

Users (and institutions on behalf of their users) can request deletion of any data at any time. Deletion is permanent, including from backups within our standard retention window.

What we don't do

We do not sell or license user data. Third parties that handle user data do so as subprocessors of Ora, under enterprise terms that prohibit them from using your data for any purpose other than providing the service, including model training. We do not run ads or use student data for advertising of any kind.

Independent audit

Ora is preparing for a SOC 2 Type II audit, with target completion in 2026. We're happy to share scope and roadmap details with your security team on request.

2FERPA Alignment

When Ora serves an institution:

• School Official Exception. We act as a "school official with a legitimate educational interest" under FERPA, using education records only to perform the institutional service you've engaged us for.
• No re-disclosure. We do not redisclose personally identifiable information from education records to any third party without authorization, except as required by law.
• Institutional control. Your institution retains ownership of, and control over, its students' education records inside Ora.
• Data Processing Addendum. Ora will execute a FERPA-aligned DPA, including the standard school-official, no-redisclosure, deletion, and audit-cooperation terms.

3AI Provider

Ora's AI backend is Microsoft Azure OpenAI Service. It runs OpenAI models (GPT-4, GPT-5) inside Microsoft Azure, the same enterprise platform that powers Microsoft Copilot, and integrates cleanly with institutions standardized on Microsoft 365 / Entra.

• No use of customer prompts, completions, or fine-tuning data to train Microsoft or OpenAI models.
• Zero Data Retention. Response storage is turned off on every request; prompts and responses are processed in memory and not retained. Microsoft's abuse-monitoring safeguards run in real time and store content only if a request is flagged as potentially abusive.
• HIPAA BAA included by default under the Microsoft Online Services Data Protection Addendum.
• FedRAMP High authorized.

Institutions with elevated requirements can add Tinfoil confidential computing (hardware-attested secure enclaves). See §4, Option A.

6Contact