Data Privacy & Sovereignty Policy

1. Information We Collect

To provide academic instruction, practical lab orchestration, and enterprise assessments, we collect strictly necessary data:

• Account Credentials: Full name, institutional email address, hashed passwords, and cryptographic session tokens.
• Academic & Range Telemetry: Course enrollments, lab container session logs, assignment commits, exam grade records, and attendance check-in timestamps.
• Enterprise Audit Telemetry: Authorized scope parameters, IP ranges, and signed non-disclosure metadata provided during consultation requests.

2. Technical Lab Logging & Isolation

All student cyber range exercises occur within isolated network environments. Network activity within virtual ranges is logged solely to prevent platform abuse, evaluate capture-the-flag flag submissions, and assess student technical mastery. Range container logs are permanently deleted 30 days after course completion.

3. Public Certificate Registry

When a student completes an academic curriculum and passes the capstone examination, a credential token containing the student’s name, course code, issue timestamp, and SHA-256 cryptographic signature is published to our public registry (`/verify`) to permit third-party employer verification. Students may request pseudonymization of their public credential records via academic support.

4. Data Retention & Security Measures

All sensitive records are encrypted at rest using AES-256 and transmitted exclusively over TLS 1.3. Access to administrative systems is restricted via multi-factor authentication, Zero Trust network proxies, and role-based access control.

5. Institutional Contact

Questions regarding data protection or requests to exercise data rights can be directed to our Chief Information Security Officer: