Magic School

Documents on the trust centre

What the vendor lists, typed; public items can be read now, the rest are available on request.

What the vendor says

Answers the vendor publishes to questions buyers ask, quoted with the link to where it says so.

• Where data is hosted or processed

  Where is MagicSchool data hosted?

  “MagicSchool data is stored and processed in U.S.-based environments operated by trusted infrastructure providers that support industry-standard security controls.”

  as of 21 Sep 2026Source

• Where data is hosted or processed

  Where can i find more information regarding MagicSchool's data security practices?

  “More details can be found here: https://www.magicschool.ai/privacy/safety”

  as of 21 Sep 2026Source

• Incident and breach notification

  Will customers be notified if a security incident affects their data?

  “Yes. If a security incident impacts customer data, MagicSchool will provide notifications without undue delay, and in accordance with applicable laws, contractual obligations, and industry best practices. We work closely with affected customers to provide timely updates and support remediation efforts.”

  as of 21 Sep 2026Source

• Use of customer data to train models

  Is District or user data used for model training?

  “No. MagicSchool does not use personal information to train AI models. Third-party providers are contractually prohibited from storing or training on district data. Both OpenAI and Anthropic certify Zero Data Retention.”

  as of 21 Sep 2026Source

• Penetration testing

  Does MagicSchool conduct penetration testing?

  “Yes. MagicSchool engages independent security experts to perform regular penetration testing of our systems and applications. Findings are reviewed, prioritized, and remediated according to our vulnerability management process.”

  as of 21 Sep 2026Source

• Data retention and deletion

  How long does MagicSchool retain data?

  “MagicSchool retains data only as long as necessary to provide services, maintain security, and satisfy legal or contractual obligations. Schools and individual adult users may request deletion or export of their data by reaching out to [email protected]”

  as of 21 Sep 2026Source