Trust & Data Protection
Who touches your data, and where.
GENIE holds the academic records of students, staff and families. We publish how we handle that data, who else touches it, and where it is processed — so that an institution can assess us before it speaks to us rather than afterwards.
The role split
Your institution is the Controller. We are the Processor.
Genesis Systems Labs & Technologies Limited processes institution data on the institution’s documented instructions. The institution remains the controller of its own records. Our standard Data Processing Agreement is published below in full — we do not ask institutions to request it.
Location
Where your data lives
Institution data is hosted in the European Union. Compute and database run in Belgium; transactional email is delivered from Ireland. Data is encrypted at rest (AES-256) and in transit (TLS).
We are asked why a Nigerian platform hosts in Europe. The answer is network performance, not regulatory positioning. The dominant subsea cable routes serving West Africa run north to European landing stations rather than around the Cape, so European hosting delivers materially faster response times to users on Nigerian mobile networks than African alternatives that are nearer in distance.
Sub-processors
The third parties that process data on our behalf
We give institutions at least thirty days’ written notice before adding or replacing any sub-processor, and an institution may object on reasonable data-protection grounds. To be notified of changes, email privacy@genesissystemslabs.com with the subject line “Sub-processor notifications”.
| Sub-processor | Function | Processing location | Status |
|---|---|---|---|
| Google Cloud Google Ireland Ltd / Google LLC | Compute, database, secret management, logging | europe-west1, Belgium | Active |
| Amazon Web Services Amazon Web Services EMEA SARL | Transactional email delivery (Amazon SES) | eu-west-1, Ireland | Active |
| Vercel Inc. | Static delivery of the web application. No application personal data is routed through Vercel — the browser addresses GENIE’s servers directly. Vercel processes access-log metadata for the delivery of static files only | Global edge network | Active |
| Anthropic PBC Claude | In-app support assistant — receives the signed-in user’s name, institution, role and typed message when a question goes beyond our built-in answers. Also the designated primary provider for the optional academic AI features, which remain switched off | United States | Active |
| Google LLC Gemini, via Vertex AI | Optional AI features — European-resident model provider | europe-west4, Netherlands | Not enabled |
| OpenAI, L.L.C. GPT | Optional AI features — secondary / fallback model provider | United States | Not enabled |
Artificial intelligence
Where we use AI, stated plainly
GENIE uses AI in two distinct places, and their status differs. We state each separately rather than describing them as one.
The support assistant is live and uses Anthropic’s Claude. Most questions in the in-app help chat are answered from our own built-in knowledge base without any AI call. When a signed-in user’s question goes beyond it, the assistant sends the user’s name, institution, role and the message they typed — together with the earlier turns of that same conversation — to Anthropic in order to answer it. Anthropic is engaged on terms that exclude training on submitted content.
The academic AI features — analysis over attendance and eligibility data — are disabled by default and are not currently enabled for any institution. We would rather withhold a feature than ship it ahead of its safeguard.
When an institution chooses to enable the academic features, the conditions below apply to them. They are contractual rather than aspirational — they appear at clause 5.5 of our Data Processing Agreement, and an institution may audit our compliance with them.
- Identifiers are removed before anything leaves our systems. Names, matriculation and staff numbers, email addresses, telephone numbers and dates of birth are replaced with per-request surrogate tokens. The mapping between token and person is held only inside our own European environment and is never sent to a model provider. What reaches the provider is a description of academic activity — that a student in a stated year of a stated programme has an attendance rate of a stated value — not a named individual.
- Your content is never used to train anyone’s model. Each provider is engaged on enterprise terms that exclude training on submitted content.
- Retention is zero or time-limited, and never for any purpose beyond delivering the response and abuse monitoring.
- Free-text fields that could carry unstructured personal information about a third party are excluded from AI payloads entirely.
- We record which provider handled each request, so we can tell an institution who processed what over any period.
If an institution requires that no academic AI processing occur outside the European Union, it may tell us so in writing and we will restrict academic AI processing for that tenancy to the European-resident provider, and confirm the restriction in writing.
We treat pseudonymised data as personal data throughout. Removing identifiers reduces risk; it does not end our obligations, and we do not claim that it does.
Security
The measures we maintain
- Authentication by short-lived tokens in httpOnly cookies, with rotating refresh and a revocation list
- HSTS preload, strict content-security policy, X-Frame-Options set to DENY, and a five-strike brute-force lockout
- Static analysis and dependency auditing in the delivery pipeline; authorisation boundaries tested adversarially
- Personally identifiable information is never attached to error monitoring
- Administrative access restricted by IP allow-list and blocked by default when no addresses are configured — including for Genesis Systems Labs itself
- Biometric matching occurs on the user’s own device; geofence verdicts are computed without retaining coordinates
- Managed database backups with point-in-time recovery enabled
- Aggregate statistics published to regulators are suppressed where the underlying group is small enough to permit re-identification of an individual
Documents and contact
Read the instrument itself
Our Data Processing Agreement — Schedule 2 of the institutional agreement — is available for download: GENIE Data Processing Agreement (PDF). The Master Software-as-a-Service Subscription Agreement is available on request.
Our compliance framework is the Nigeria Data Protection Act 2023 and the Nigeria Data Protection Commission’s General Application and Implementation Directive.
Data Protection Officer: Barrister Olufemi Ogunnubi
Data protection enquiries: privacy@genesissystemslabs.com
General: support@thegenieos.com · +234 806 540 4939
This page states our position as at 6 September 2026 and is revised whenever the underlying position changes.