EdTech & trainingYour AI tutor produces content
Your AI tutor produces content
and acts on learner journeys.
Content generation, automated feedback, learner data access: an EdTech agent reads user-submitted text at volume and executes actions on your platform. We test these chains on your sandbox.
Applicable regulations
CNIL: Children's data protection
Active priorityChildren's data protection is a CNIL strategic priority 2024-2026. Parental consent required under 15, enhanced security obligations.
GDPR: Educational data
In forceAcademic results, progression data, family information: this personal data requires security measures proportionate to its sensitivity.
Education Code
In forcePlatforms used in educational settings must guarantee student data protection (Art. L. 131-2 and following).
Common edtech vulnerabilities
- APIs exposing student data (grades, progress, personal information) without adequate authentication
- Cross-user access: one student can view another student's data
- Unauthenticated webhooks allowing admin or instructor account creation
- Paywall bypass on paid training platforms (free access to premium content)
- Identity documents (ID cards, certificates) stored in public buckets
- Missing age verification and parental consent mechanisms
We found an unauthenticated webhook on a training platform that allowed admin account creation, with full access to user data, premium content and payment information in 2 minutes.