admitur Security and privacy
Students tell you who they are. Admitur is built so that the AI never needs to know, and so that your staff can always show who saw what.
Personal details never reach the model#
Before any model is called, names, email addresses, phone numbers, passport and identity card numbers and application numbers are replaced with placeholders such as [NAME_1] and [PASSPORT_1]. The model writes its reply with the placeholders, and they're swapped back only in the student's own chat window.
If a message still contains something that looks like an ID number after masking, it isn't sent to a model at all. The student is asked to leave it out.
Your own database#
Each institution has its own database. Inside it, every table is also locked to your institution at the database level, so even a mistake in our code can't show your data to another institution. The app connects with an account that owns nothing and can only read and write through those locks.
Encryption#
- Students' real contact details are stored encrypted with a key that belongs to your institution, separate from the conversation, which is stored masked.
- If you use your own AI key, it's encrypted with your institution's key and never shown again.
- All traffic to Admitur is over HTTPS.
Signing in#
Staff sign in with a one-time link sent to their work email. There's no password to reuse, guess or phish. A session ends after the idle time your admin sets, or when the person signs out. Removing someone signs them out on every device at once.
Single sign-on with your institution's Microsoft or Google account is coming.
Who can see what#
- Officers see only their own teams' cases. Editors see content, not cases.
- Conversations are shown masked. Seeing a student's real details takes a deliberate Show details, which is recorded with the officer's name.
- Our support staff can't open your cases. If we need to, we ask, and your admin approves access to one case for a set time.
- Notifications on phones carry a case reference and a team, never a name or a message.
- The console app on phones stores no case data on the device.
Audit#
Everything that matters is logged: every lookup the assistant makes, every change to a case, every reveal of a student's details, every admin action and every content approval. Logs can be added to but not edited.
Retention#
Old data is deleted automatically, every hour, according to your settings:
| What | Default | Choices |
|---|---|---|
| Conversations (masked) | 12 months | 6, 12 or 24 months |
| Closed cases and their history | 24 months | 12, 24 or 36 months |
| Students' contact details, after their case closes | 90 days | 30 or 90 days |
In the widget, the conversation is kept only in the student's own browser, and New chat clears it.
Students' requests#
When a student asks to see, correct or delete their data, record it in Admin → Security and privacy. Each request gets a 21-day due date so it doesn't slip.
Where data is processed#
Your database and the platform run on our servers in Malaysia. The managed AI models are provided by Anthropic, whose processing can take place outside Malaysia. Only masked text and your approved content are sent to them.
In-country and self-hosted model options are coming, for institutions that need all processing to stay in Malaysia.
Protection from abuse#
- Attempts to make the assistant ignore its instructions are detected, refused and dropped from the conversation.
- Each agent only runs on the websites you list.
- Message limits per visitor, per agent and per institution stop anyone running up your usage. Visitors are counted by a salted hash of their IP address, never the address itself.