Trust center
How we protect your academy's data
facultyOS is a data processor (수탁자) that handles data on behalf of your academy under Korea's Personal Information Protection Act. What follows isn't marketing — it's controls that are live in the product today.
- AES-256 at rest
- Append-only audit log
- Existence-only display
- PIPA processor
- No data selling
Encryption at rest
ARC numbers (외국인등록번호), passport numbers, phone numbers, and payroll and housing details are encrypted with AES-256 before they ever reach the database. The key lives outside the database, so the database file alone can't reveal the originals. Documents you upload — applicant résumés and business-registration and academy-license PDFs — are encrypted with the same key before they touch disk. Passwords are stored only as a one-way bcrypt hash — never in readable form.
Encryption in transit
All traffic between the browser and our servers is encrypted over HTTPS (TLS).
Existence-only display
In day-to-day screens, sensitive fields show only whether a value exists — a check, not the value. Staff can confirm a document is on file without the raw ARC or passport number ever being rendered back to the browser.
Append-only audit trail
Every create, edit, import, and export of a teacher record is written to an audit log — who, what, and when. It is append-only by design, so the history is there when you need to trace it.
Your data stays yours
Data your academy enters belongs to your academy. We never sell it or share it, and we process it only within your instructions. Delete your account and the data is purged within 30 days — except billing and contract records the law requires us to keep.
Hosted in Seoul · sub-processors in the open
Your teacher data — servers, database, and backups — is hosted in Seoul, South Korea (AWS Seoul region), not overseas. We also name every third party that can touch data: CDN & security (Cloudflare, US), email delivery (Google Workspace), and — only if your academy turns on AI features — AI processing (Anthropic, US). The Anthropic API does not train on your input data. Because CDN, email, and AI processing happen partly outside Korea, our privacy policy discloses that cross-border transfer.
Read the privacy policyThe paperwork your compliance needs
Your academy is the controller; facultyOS is the processor.
To back your own PIPA obligations, we provide a standard data-processing agreement (개인정보 처리위탁 계약서) you can hand straight to your auditors.
View the data-processing agreementContact
- Privacy officer (CPO)
- privacy@facultyos.ac
- Report a vulnerability
- security@facultyos.ac