Data security overview
A concise guide to storage, confidentiality and user control.
Trust through transparency.
How we handle data. Open and transparent.
Alera Trust Center
Understand our security. Explore the documents. Get answers. Find information about our data processes and the evidence covering our cloud infrastructure.
Resources
View allData security
AI and data
Standards and evidence
Documents and evidence
Alera information and evidence for Google Cloud, Firebase and OpenAI. Each document identifies its publisher, scope and access options.
10 documents
AI and data processing
How AI responses are generated and how we handle chat content, training and voice features.
BSI C5 Type 2 · Google Cloud
C5 Type 2 assessment of Google Cloud Platform for 1 April 2025–31 March 2026. Access to the report is provided by Google.
ISO 27001 · Google Cloud & Firebase
Original certificate for Google’s information security management, including named Firebase services. Reissued on 12 January 2026 and valid until 14 May 2027.
ISO 42001 · Google Cloud
Original certificate for Google’s AI management system. Issued on 10 November 2025 and valid until 24 November 2027.
ISO 27017 · Google Cloud & Firebase
Original certificate covering security controls for cloud services, including named Firebase services. Valid until 14 May 2027.
ISO 27018 · Google Cloud & Firebase
Original certificate covering the protection of personal data in public cloud services, including named Firebase services. Valid until 14 May 2027.
ISO 27701 · Google Cloud & Firebase
Original certificate for Google’s privacy information management, including named Firebase services. Valid until 14 May 2027.
ISO 27001 & 27701 · OpenAI
Original certificate for OpenAI’s information security and privacy management, including the API. With ISO 27017/27018 cloud controls; valid until 7 August 2028.
SOC 3 · OpenAI
Official provider source for the SOC 3 report covering 1 July 2025–30 June 2026. The original is available through the OpenAI Trust Portal.
No matching documents found.
Service providers and processing
Storage and processing have different roles. This overview covers the central services; full details are available in the Privacy Policy under Legal in the footer.
Google Cloud
Cloud infrastructureInfrastructure for Alera’s central data storage. The linked C5 and ISO evidence is issued for Google and applies to the scope identified there.
Firebase
App servicesGoogle’s ISO 27001, 27017, 27018 and 27701 certificates include named Firebase services for Enterprise Customers. Applicability follows the stated scope and agreement. The Privacy Policy also lists US processing locations for Functions, Firestore and Storage.
OpenAI
AI responsesProcesses the requests required to generate AI responses. Alera does not enable training with API data. Separate abuse-monitoring logs are distinct from model training.
Frequently asked questions
Which documents can I view directly?
Alera’s overviews, original Google ISO certificates and OpenAI’s combined ISO certificate are available as previews and downloads. The named Firebase services are covered by four Google certificates. OpenAI’s SOC 3 report is linked directly at the provider; Google provides the C5 report through its Reports Manager.
What do Google Cloud’s C5 and ISO 27001 documents cover?
These documents cover the infrastructure and services identified by Google. The original source describes the specific scope. Provider evidence is separate from evidence issued specifically for Alera.
Is all data processed exclusively in Germany?
Alera’s central data storage is in Frankfurt am Main. Some functions use additional service providers, including OpenAI with processing in the USA. Central storage is therefore distinct from the processing of individual requests.
Are my conversations used for AI training?
We do not use chat content to train our own models or enable training with OpenAI API data. Separately, OpenAI may retain inputs, responses and metadata in abuse-monitoring logs for up to 30 days, subject to the exceptions described in the Privacy Policy.
Can my school access personal chats?
No. Schools and parents cannot access personal chats. Schools receive aggregate usage data only. Necessary service providers process the data required to deliver the app functions you choose.
Have more questions?
We can help you understand the documents and answer questions about Alera’s data processes.