Security & Privacy

Self-Hosted by Design

Unlike SaaS chatbots that send your conversations to external servers, Campus Assistant runs entirely on your Moodle server. The plugin lives inside your Moodle installation — same server, same database, same security perimeter.

What stays on your server:

• All chat conversations (stored in your Moodle database)
• All user data (student names, course info, grades)
• All configuration and API keys (encrypted in Moodle settings)
• All conversation logs and usage analytics

What leaves your server: Only the specific question a user types in the chat, sent directly to your chosen AI provider (OpenAI, DeepSeek, Gemini, or Claude) via their API. You use your own API key, and the provider's data policies apply to that exchange.

GDPR Compliance

Campus Assistant is designed to support GDPR compliance for educational institutions:

• Data residency: Your data never leaves your server unless you explicitly configure an external AI provider.
• No third-party tracking: Zero analytics, zero cookies, zero tracking pixels from external services.
• No external CDNs: All JavaScript and CSS is bundled with the plugin. No requests to Google, Facebook, or any third-party domain.
• Data portability: All conversations are stored in standard Moodle database tables. Export or delete them at any time.
• Right to erasure: Purge conversation logs automatically via Moodle cron (configurable retention period).

Security Architecture

Authentication & Authorization

• Only logged-in, non-guest users can access the assistant
• Requires local/campusai:use Moodle capability
• Role-based access: admin, teacher, and student functions are strictly separated

Input Security

• All AJAX requests require POST method (GET returns 405)
• CSRF protection via Moodle's sesskey()
• Rate limiting: configurable per-user message limits to prevent abuse
• Conversation logging truncated: input capped at 500 chars, output at 2000 chars

License Protection

• JWT-based license validation with 24-hour cache
• Domain-locked licenses — a key issued for campus A won't work on campus B
• 7-day grace period for server-side validation failures
• Plugin stops rendering if license is invalid (no content leaks)

Audited Against Moodle Security Guidelines

Version 2.2.1 passed a full security audit against the official Moodle Security Guidelines and Plugin Security Checklist. 15/15 checks passed, 0 outstanding issues.

AI Provider Data Handling

When a user sends a message, the plugin:

1. Reads the user's question
2. Calls the relevant Moodle function(s) to gather context (course list, grades, deadlines, etc.)
3. Sends the question + function results to your configured AI provider
4. Receives a natural-language response and displays it
5. Stores the conversation in your Moodle database

The AI provider only sees the specific question and the contextual data pulled by the functions. It does not receive bulk user data, course exports, or anything the user didn't ask about.

Tip: For maximum privacy, use a self-hosted AI model (like Ollama or LM Studio) via the OpenAI-compatible API endpoint. Campus Assistant works with any provider that exposes an OpenAI-compatible API.

Reporting a Vulnerability

Found a security issue? Email us at hola@campusassistant.app with details. We respond within 48 hours and prioritize security fixes above everything else.