Where your data is: CoreSkills' security and data protection through IT's eyes

In brief

CoreSkills is its own, separate cloud service, located in Finland. The customer organisation is the controller of its staff's data and CoreSeer Company Oy their processor. The service needs of a learner only a name and an email, and the rest arises from use: completions, exam results, certificates and conversations with the AI teacher. Text goes to the AI without the learner's name and email, by default to the OpenAI API, which is not used to train models, or to the organisation's own Azure OpenAI if it has been taken into use. Microsoft connections are optional, and the customer's own administrator approves each one.

Where the service is

The application, the database and the files are in Google Cloud in Finland, in the Hamina region: the application in Cloud Run, the database in Cloud SQL, and audio, images and uploaded source documents in Cloud Storage with public access blocked. Keys and credentials are in Google Secret Manager. The release pipeline authenticates to Google Cloud without keys.

CoreSkills is not installed into the customer's Microsoft 365 environment or servers. There is a separate test environment where changes are seen before production, and no customer data is taken into it.

Who is what

The customer organisation is the controller of its staff's personal data and decides who uses the service and for which training. CoreSeer Company Oy is the service provider and the processor of personal data on the customer's behalf. A reseller may be the customer's contracting party, but the technical service and the processing are CoreSeer's. A data processing agreement is made between the customer and the service provider, and its template is supplied with the offer.

The lawful basis is defined by the customer as controller. For staff training it is typically the employer's legitimate interest or a legal obligation, for example the training requirements of the GDPR, the Cybersecurity Act and the AI Act.

What data is processed

Category	Examples	Purpose
Basic user data	name, email, role, organisation, language	authentication and use
Learning and completions	daily tasks, answers, completed courses, skill levels, exam answers and scores, certificates	delivery of training and evidence of the obligation
AI conversations	the learner's messages to the teacher and in practice, and the replies	practice; the AI's assessment is advisory and grants no competence
Reminders	channel, send time, time zone, Teams identifier	the daily reminder
Own courses	documents the administrator uploads and the courses made from them	the organisation's own courses
Organisation description	trade register data, description of activity, headcount; no personal data	examples in own courses
Technical data	server request logs, send log	operation and troubleshooting

The service does not process personal identity numbers, salary or health data or other special categories of personal data. Learners write into conversations themselves, so staff are instructed not to write customers' or other people's data into them; the same applies to the source documents of own courses.

Where data flows

Traffic between the user and the service is encrypted. Only text goes to the AI: the learner's own messages, the courses' text and the documents uploaded for courses. The learner's name and email are not sent, but the text is not anonymised: a person's name written into a conversation or a document goes as it is, which is why staff are instructed not to write other people's data into them. Speech synthesis receives only a course's narration text and image generation only a video scene's title. Email receives the recipient's address, first name, the day's tasks and a link.

The subprocessors to which personal data may flow are Google Cloud (server, database, files; Finland), OpenAI (text AI, if the organisation has no Azure OpenAI of its own; the learner's messages without account identity; United States), Resend (email delivery; United States) and Microsoft (the Teams bot, only if Teams is taken into use). Under the OpenAI API terms, data sent through the API is not used to train models. An organisation that does not want AI processing transferred to the United States can take its own Azure OpenAI into use in an EU region; that moves only the model calls, and transfers by other services, such as email delivery, are assessed separately in the data processing agreement. Changes to subprocessors are announced in advance as the data processing agreement provides.

Own Azure OpenAI, Entra ID and Teams

Every connection to the customer's Microsoft environment is optional. Without them CoreSkills works with a browser and email alone.

Own Azure OpenAI. An organisation can take its own Azure OpenAI resource into use. Then the text AI runs in the organisation's own Azure tenant: learners' conversations and the production of own courses go through it, and the cost shows on the organisation's Azure bill. CoreSkills gets no keys; the organisation grants CoreSkills' application a reader role and the OpenAI user role on its own resource. Before the first call CoreSkills checks that content logging for abuse monitoring is off and that only models sold by Azure are in use, and repeats the check at least every six hours. If the resource is unavailable, the call fails; CoreSkills does not silently move it to its own AI. An EU region is recommended.

Entra ID. The customer's Entra administrator grants consent to CoreSkills' application, which requests only basic sign-in permissions. It has no application-level permissions, so it does not read the directory, emails or files. The connection can be cut at any time. Staff single sign-on and automatic provisioning from Entra ID are under development.

Teams. The CoreSkills bot works only in personal chats. It does not read channels, teams or the user's other data, and the organisation can limit which tenants may use the bot. A user links their own Teams account with a one-time code valid for 15 minutes.

The recommended set-up for a Microsoft 365 organisation is its own Azure OpenAI in an EU region, Teams limited to its own tenant, and email reminders.

An organisation description without names

The examples in own courses are made from the organisation's own work, so CoreSkills keeps a short description of the organisation: what it does, for whom, with how many people, and what matters for security. The basic data comes from the trade register's open data, and the rest is compiled by AI from public sources. No person's name is stored in the description, not even management's. The AI-compiled description is a draft that is not used until CoreSkills' administration has checked it, and the administrator can correct it; every change leaves a record. Turnover and financial position are background only and do not end up in courses.

What is not done

The customer's material is not used to train AI models. That is a licence condition binding every service on the request path, the customer's own Azure included. The AI grants no competence: the practice assessment is advisory, and a certificate rests on a multiple-choice exam. No data is imported from the customer's HR system, and the Teams bot does not read channels. The full description of security and data protection in the structure of a vendor assessment, with retention periods and risks, is in the product's guides for the administrator.