Student data and AI assistants: seven rules a coaching institute should insist on

Whether your teachers should use AI assistants is no longer the real question. Many already do, often by pasting a spreadsheet of names and marks into a chat window. The real question is whether your institute has decided how it should be done. Most have not, and that is a governance gap, not a technology one.

What follows is the checklist we used while building the Mocxam AI connector. It applies whichever product you use, including ours. Where Mocxam is relevant I say what it does, so you can hold us to it.

This is practical guidance, not legal advice. Data-protection obligations depend on your institute, your students' ages and your contracts. Take advice for your situation.

1. One login per teacher

A shared "institute" account in ChatGPT or Claude means you can never answer the simplest question after an incident: who asked for this? Each teacher should connect with their own credentials, and the AI app should never see the password. In Mocxam, each teacher signs in through OAuth and the connection belongs to them alone.

2. Scope by institute at the server, not in the prompt

"Only look at our institute" is an instruction, not a control. A control is a system where the institute is fixed when the teacher signs in, and no request can change it. Ask any vendor where the scoping happens. If the answer involves the prompt, keep looking.

3. Send the minimum the task needs

To rank students by Quant accuracy, an assistant needs names or roll numbers, batches and scores. It does not need phone numbers, parents' emails, addresses or fee status. A pasted spreadsheet sends everything. A well-designed connector returns only the fields each tool needs.

4. Prefer named tools to open queries

A tool called students_needing_attention does one thing you can describe to a parent. A tool called "run query" can do anything, which means you cannot describe what it did. Named tools are also easier to audit and easier to switch off one by one.

5. Log every request

Logs are how trust survives a bad day. You want a record of which teacher called which tool, and when. Mocxam writes every tool call to the institute's audit log, and branding or staff changes record the old values too.

6. Make switching off immediate

When a teacher leaves, their AI access should end that day, not when someone remembers. Check that you can revoke one person instantly, and that a plan or contract change switches everyone off without a support ticket.

7. Write your institute's own policy

Software cannot decide this part for you. A one-page policy should cover which AI apps staff may use, whether chat history may be used for model training (check each provider's settings; Anthropic and OpenAI both publish controls), what may never be pasted in, and how you treat students under 18. Share it with faculty and revisit it each term.

Seven questions to ask any vendor

If a vendor cannot answer these plainly, that tells you something. If we ever cannot, tell us. The full detail of how our connector handles data is on the AI connector security page and in our privacy policy.

The point of all this

Rules like these are not there to slow teachers down. They are what let a director say yes to AI with a clear conscience, and explain that yes to a parent who asks. Institutes that set them now will move faster later, because they will not have to unwind habits formed in a hurry.