Security isn't an add-on. It's foundational to how we build and operate Full Fabric. We partner with third-party security experts, conduct regular penetration tests and vulnerability assessments, and follow industry best practices to protect your data from threats. Your institution's information and your students' privacy are safeguarded at every level.
Higher education institutions handle some of the most sensitive personal data. Full Fabric gives you granular control over who accesses what, ensuring compliance with GDPR and other data protection regulations. All sensitive information is encrypted during transmission using TLS 1.2 or higher, so data remains secure as it moves between systems.
Full Fabric's ISO/IEC 27001:2022 certification covers our Information Security Management System (ISMS), which governs the assets, technologies and processes we use to process, manage and deliver our services to Customers. The scope is defined for the Full Fabric platform and service as a whole.
The AI Console is a feature of the Full Fabric platform, not a separate product. It runs on the same infrastructure, works against the same data, permissions and workflows as the rest of the platform, and is built, operated and supported by the same teams under the same controls, including secure development, access control, change management and incident management. It therefore falls within the certified scope.
AI features are disabled by default and remain under the Customer's control. Each institution decides whether to enable or disable AI capabilities for its instance, and can restrict which users have access to them through role-based permissions. AI features can also be configured to limit or exclude access to personal data. Enabling or disabling AI features does not change the scope of our certification: the same security controls apply either way.
The AI models behind the AI Console are provided by third party AI subprocessors, listed in the AI subprocessors section of our Data Processing Agreement. These providers operate under Zero Data Retention (ZDR) terms: personal data sent for processing is not retained by the provider beyond the processing session and is never used to train models or for any other purpose. We manage these providers through our supplier security review process and contractual safeguards. Our certification covers how Full Fabric selects, contracts and oversees them, not the providers' own environments, which are covered by their own security programmes.
To request a copy of our certificate or more detail on scope, please contact compliance@fullfabric.com.
Full Fabric's student-facing applications are designed and tested to conform with WCAG Level AA. Our accessibility programme also addresses the applicable requirements of EN 301 549 and supports institutions in meeting their obligations under European accessibility legislation, including the European Accessibility Act and Web Accessibility Directive.
