LMS security and data privacy, explained plainly
Schools, universities and companies trust their LMS with children's records, grades and personal details. This page sets out what Ilmoria does to protect that data today, and the tools it gives your team to manage access and respond to data requests. For a fuller overview, see our security page.
Encrypted in transit and at rest
Data is encrypted while it travels and where it is stored.
Access follows the role
People see and do only what their role allows, with audit trails of important actions.
Backed up every day
Daily backups on enterprise-grade cloud infrastructure.
How your data is stored
Ilmoria runs on enterprise-grade cloud infrastructure. Data is encrypted in transit, as it moves between a user's device and the platform, and at rest, where it is stored. Each organisation's data is isolated from every other organisation at row level, and within a group, each school, campus or business unit keeps its own users and data separate, as described on the multi-school page. Ilmoria takes daily backups. If your institution has requirements about the region where data is hosted, talk to us about them during procurement.
Who can see what
Access in Ilmoria follows the job a person does. Role-based permissions separate administrators, teachers, students, parents and student-affairs staff, and in corporate accounts, admins, managers or trainers, and employees. A parent sees their own children's progress, grades and invoices, not anyone else's. Staff and learners sign in with email and password, Google or Microsoft. On Enterprise plans, SAML single sign-on lets your IT team manage access through the identity provider it already uses, so when someone leaves, their access can be removed in one place.
Oversight and audit trails
Ilmoria keeps audit trails of important actions, so administrators can see what changed and who changed it. Records that matter are protected by workflow, not just by permissions. Final grades need teacher confirmation and can be locked, and an admin override requires a reason. Official transcripts go through an approval step and are issued as locked PDFs. When support is needed, administrators can “log in as” a user in update mode or in read-only stealth mode to see exactly what that person sees, and the session expires automatically after 2 hours.
Tools for your data-protection obligations
Your institution decides what data it collects and why. Ilmoria provides tools that help you meet your data-protection obligations, so you can respond to requests from families, students and employees. Review your obligations with your own legal or data-protection adviser, and use Ilmoria's controls to act on them.
- Consent records that show what people have agreed to
- Access controls that limit each role to the data it needs
- Data export on request, including CSV export of users, courses and grades
- Data deletion on request, when a record should no longer be kept
Safeguards built into everyday work
Security is also about the small decisions inside each workflow. Ilmoria builds safeguards into exams, documents and accounts, so they protect your institution as part of normal use rather than as extra steps. Anyone can check that a certificate is genuine through its public verification page, as explained on the certificates page.
- Each quiz attempt gets an integrity score from browser events, such as leaving the tab, and suspicious attempts are flagged for teacher review
- Students can download a question paper, but never the answers
- Certificates carry serial numbers and QR codes
- Registration links for applicants are private and single-use
- Student demo accounts expire automatically
Questions buyers ask
Where is our data hosted?
Ilmoria is hosted on enterprise-grade cloud infrastructure, with data encrypted in transit and at rest and backed up daily. If your institution or regulator expects data to be hosted in a particular region, talk to us about your hosting-region requirements during procurement, and we will discuss them with your IT team.
Do you support single sign-on?
Yes. Users can sign in with Google or Microsoft accounts as well as with email and password. SAML single sign-on is available on Enterprise plans, so your IT team can manage access through its existing identity provider and apply the same sign-in rules it uses for other systems.
Can we export or delete our data?
Yes. Ilmoria provides data export and deletion on request, alongside consent records and access controls, to help your institution meet its data-protection obligations. Users, courses and grades can also be exported as CSV files, so your team can keep its own copies or move data into other systems.
Can administrators see what a student or parent sees?
Yes. Administrators can “log in as” a user to see exactly what that person sees, either in update mode or in read-only stealth mode, which cannot change anything. The session expires automatically after 2 hours, so temporary support access does not stay open by accident.
Does Ilmoria make us compliant with data-protection law?
No software can make an institution compliant on its own. Ilmoria provides tools that help institutions meet their data-protection obligations, including consent records, access controls, and data export and deletion on request. How you collect and use data still matters, so review your obligations with your own legal or data-protection adviser.
How are backups handled?
Ilmoria takes daily backups of your data on enterprise-grade cloud infrastructure. Backups sit alongside encryption in transit and at rest and row-level isolation between organisations. If your IT review needs more detail about backup and recovery arrangements, ask us during procurement and we will go through them with you.
See Ilmoria with your own school in mind
A 30-minute call with a product specialist. Bring your timetable, your grading rules and your toughest question. We will show you how it works for you, in English or Arabic.