Privacy and security

# External services and data handling / 外部服務及資料處理

Last reviewed: 2026-09-22. This register distinguishes inspected configuration from contractual approval. A configured hostname does not establish a data-processing agreement, hosting region or retention guarantee.

## Current English service status / 英語服務現況

LearnSys English is available with iGears self-hosted text assessment and the owner-operated r39 API 1.3.0 for full-recording English speech recognition, forced alignment and uncalibrated acoustic evidence. The final integration entry below describes the active service and its deletion controls. Pronunciation grades remain uncalibrated and are not shown as numeric marks. School AI enablement, server-side credentials, text redaction and content-free usage records apply. The public demonstration uses fictional accounts and sample work only. Confirm each school's actual hosting location, retention configuration and service terms before real pupil processing.

LearnSys 英語學習已上線，接入 iGears 自行託管的文字評核及 r39 語音服務，提供整段英語錄音辨識、對齊與聲學資料。文末的正式整合紀錄說明現行服務及刪除控制。發音評分尚未校準，目前不顯示發音分數。公開示範只使用虛構帳戶及示例內容；真實學生使用前須確認該校託管、保留設定及服務條款。

## Dated implementation and review history / 按日期保留的實作與審查紀錄

The entries below record the state at their original review dates. Earlier statements about simulation-only operation, missing credentials, failed tests or an inactive adapter were superseded by the later repairs and the 22 September integration entry. They do not describe the current product availability. Pending approvals for other services are unchanged.

以下保留各次審查當時的狀態。早期有關只限模擬、欠缺憑證、測試失敗或尚未接入的記錄，已由後續修正及九月二十二日整合記錄更新，不代表產品目前仍在開發中。其他服務尚待確認的事項維持不變。

| Service | Purpose / data | Evidence and approval status |
| --- | --- | --- |
| School VM / Hong Kong hosting selected by the school | MySQL school records, Redis jobs, MinIO files | School deployments are designed for isolated local storage. The customer must confirm the host and location. |
| `mail.igears.com.hk` | Existing application email delivery, message addresses and notification content | SMTP hostname and enabled flag inspected; processor terms, retention and physical hosting confirmation pending. |
| `www.sendpromotion.email` | Existing contact/quotation forwarding, contact details and enquiry text | Endpoint is configured in the existing app. Forwarding also requires credentials and sequence configuration. Contract and residency confirmation pending. Do not send student learning records. |
| Existing unnamed AI gateway in the supplied brief | Potential legacy AI processing | Legal operator, approved region, no-training and zero-retention terms have not been verified. New student AI integrations must remain mocked or disabled until approved; do not claim compliance based on the gateway address. |

New school installers leave external AI and email disabled. No new external processor has been approved by this implementation. Build tools, package registries and the browser test runtime are not used to send school records.

新學校安裝預設停用外部 AI 及電郵。外部服務須先確認營運者、合約、資料所在地及保留安排；設定了服務網址並不代表已完成審核。不可將真實學生學習紀錄傳送至尚未獲准的 AI 服務。

## English AI gateway

`packages/ai` currently permits only the local simulation adapter. It executes on the school server, sends no requests to a processor, records character counts and cost metadata without prompts or responses, requires a per-school enable switch, and enforces the monthly budget before reserving usage. All external adapters are refused until the provider allowlist and no-training/zero-retention contract checks have been approved. Simulation output is explicitly labelled; placeholder scores are not educational assessments.

英語 AI 閘道目前只允許學校伺服器上的本機模擬，不會呼叫外部服務。只記錄字元數及費用資料，不記錄提示或回覆。須先啟用校本開關，並受每月預算上限控制。外部供應商須完成核准名單、禁止訓練及零保留合約審批。模擬分數並非學習評核。

## Speaking adapters / 口說介面

Speech-to-text, pronunciation and language-model assessment adapters are defined in `packages/ai`. No external speech processor is approved or called. Direct-provider session credentials, if an approved adapter is later supplied, must expire within five minutes. Current browser audio goes only to school MinIO; bounded FFmpeg decoding and pinned libfvad WASM voice-activity detection execute locally. These local libraries are not external subprocessors. The simulation does not invent transcripts or claim valid pronunciation scores. Demo voices use local eSpeak NG with an original fictional script.

口說目前只在學校儲存及處理錄音，不會連接外部語音服務。外部 STT／發音／模型供應商及直接連線短效憑證須先完成審核；現行示範不會捏造逐字稿或聲稱有效的發音分數。

## Review controls added in September 2026 / 二○二六年九月新增管控

- Cloudflare: existing reverse proxy confirmed by the operator; processes web traffic including IP addresses and requested pages. TLS origin uses the existing wildcard certificate. School contracts must identify the actual edge/hosting arrangement.
- Sentry: optional legacy error tracking. Disabled unless `SENTRY_APPROVED_PROCESSOR=true`; approval, residency and retention are pending. Approved configurations suppress request content, user details, extra data, breadcrumbs and exception messages; tracing is disabled.
- Google reCAPTCHA / hCaptcha: optional legacy bot verification, receiving verification tokens. No new credentials or activation were added. Schools must approve the selected provider before enabling it.
- Microsoft / Google or a school-selected identity provider: SSO subject/claims processing. No active school SSO configuration was found. SAML remains disabled unless separately approved, on a dedicated single-school server, and outside demo mode. Remote metadata is bounded, refuses redirects, and accepts only the named Microsoft/Google metadata hosts; other providers require locally verified XML. Production activation still needs school credentials and identity/security acceptance tests.
- Local BGE embeddings: runs on the school server, restricted to explicit local service hosts through `packages/ai`, with the school enable switch, redaction and usage audit. It is not an external processor. Legacy external chat/model calls are refused until a provider contract is approved.
- Local eSpeak NG: synthetic vocabulary/audio demonstrations execute locally and transmit no text to a speech provider.

All public demo notifications remain local simulations. Push providers and mobile app-store services are not activated; their contracts, credentials and native acceptance tests remain pending.

### iGears self-hosted assessment — 20 September 2026

The owner identified the configured text assessment API as an iGears self-hosted service. The `igears-self-hosted` adapter uses the existing server-side endpoint/model/credential configuration; credentials and endpoint details are never returned to the browser. This is an operator-managed processing service, not an assumed third-party AI contract. Tenant administrators select/enable it; the simulation remains separately labelled.

The shared gateway redacts known student identifiers, meters requests and character counts without logging student content, applies a timeout and response-size/schema checks, and sends `store:false`, no-training and zero-retention requests. iGears must enforce those policies on its service. An API parameter or a synthetic test does not independently verify host location, request logging, model training or retention. Confirm Hong Kong/school-hosted residency and logging/retention configuration before real school data processing. Synthetic demonstration testing uses fictional work only. Provider failures do not consume an essay/session entitlement.

Local speech inference, when configured, uses model files installed on the school application server. Recordings and decoded text are not sent to a model-download host; runtime inference must use local files only. Model distribution is a software supply source, not a recipient of student data. Temporary audio is owner-readable and removed after inference. Saved school recordings remain subject to existing expiry and student/tenant removal controls.

### School-owned speaking services, 20 September 2026

Speech recognition and sampled phoneme comparisons execute on the school server using pre-downloaded open-source model weights. Software registries receive installation downloads only; they receive no student audio. Local eSpeak NG produces AI-partner speech without an external speech processor. The owner-operated authenticated TURN relay forwards encrypted WebRTC audio, stores no recording and suppresses session logs; room membership, short-lived signalling and each learner's explicitly submitted individual recording remain school data. Signalling expires after 20 minutes; submitted recordings follow the assignment retention setting. Teacher/participant microphone consent is recorded. Group recordings contain each learner's own microphone; headphones are advised to prevent acoustic pickup of others. No third-party meeting platform is used.


### iGears r39 speech API review — 21 September 2026

The user supplied the integration document for an iGears self-hosted pronunciation service at r39.igt.com.hk. Diagnostic tests sent locally generated synthetic speech only; no real learner recordings or personal data were used, and this service has not been connected to the production SpeechAdapter. English alignment passed up to 600 seconds; GOP, calibrated scores and ASR are unavailable, and four Mandarin fixtures failed. Repeated DELETE responses claimed cleared while six completed synthetic results remained readable; cancellation, idempotency and caller-isolation also failed the proposed integration acceptance conditions. These are blockers before real learner processing. The service advertises a 24-hour TTL but the scope and backend erasure/logging policy are not verified. Registration here records a reviewed candidate, not approval of real-data processing or a claim of Hong Kong residency/no-training/zero-retention enforcement. See [functional review](../integrations/speech-api-review-2026-09-21.md).


### iGears r39 API 1.2.0 follow-up — 21 September 2026

Unauthenticated job creation (valid multipart), status/result retrieval and deletion are now rejected; an invalid credential was also rejected. Public OpenAPI endpoints parse successfully. No valid test client credentials were available in this review, so new deletion/cancellation/idempotency, school isolation and inference claims have not been independently retested. The service documents 24-hour content retention and CPU ASR limited to 45 seconds; this is not the previously proposed processing-only retention/complete-clip acceptance. New GMM acoustic evidence is uncalibrated and has not been independently validated here. This remains a candidate integration, with no production speech adapter/configuration change and no real learner data transmitted. See [1.2.0 review](../integrations/speech-api-recheck-v1.2.0.md).


### iGears r39 authenticated retest — 21 September 2026

The owner supplied a reusable service credential. Synthetic-only authenticated testing passes idempotency conflicts, a small duplicate-request race, queued/active cancellation and completed-job deletion/replay. All 22 newly created test jobs returned 410 at final result checks. This verifies HTTP inaccessibility, not independently inspected erasure from r39 files/Redis or restart/expiry recovery. Only one valid school identity was available, so cross-school credential isolation remains untested. The previous eSpeak Mandarin fixtures were invalid (English rendering of pinyin/tone numbers); natural Mandarin synthetic replacements pass basic recognition/alignment but expose Simplified/Traditional false omissions and Traditional 書 OOV. ASR stops above 45 seconds and a 600-second recording skips GMM evidence as well; 24-hour processing-content retention remains. Credential lifetime was not changed and should not be confused with content retention. The service is still not connected to the production SpeechAdapter. See [authenticated review](../integrations/speech-api-authenticated-recheck-v1.2.0.md).


## 2026-09-21 owner scope clarification: separate school servers

The owner confirmed separate production servers per school and excluded second-school cross-client tests from this acceptance scope. A second-school credential is not required for this task. Existing Bearer authentication and job ownership controls remain required. This scope decision does not claim shared-server isolation has been tested; other recorded functional and processing-policy findings still apply.


## 2026-09-21 r39 API 1.3.0 direct repair and backend verification

The owner authorized direct changes on the existing iGears r39 speech server. English and Mandarin 600-second local ASR/alignment/GMM processing, script normalization, backend cancellation/erasure, real HTTP expiry and typed API contracts were verified with synthetic recordings. Content is capped at 60 minutes from acceptance and 15 minutes after processing, with content-free tombstones retained at most 24 hours after deletion/expiry; token lifetime remains unchanged. The LearnSys remote adapter has not been activated. Human educational validation and actual school deployment remain separate. All 22 created test jobs were cleared, no inference processes remained and HTTPS from this LearnSys host passed. See [deployed repair and acceptance report](../integrations/speech-server-repair-v1.3.0.md).


## 2026-09-22: owner-authorised private speech integration

LearnSys now uses the owner-operated iGears r39 API 1.3.0 for full-recording English ASR, forced alignment and uncalibrated acoustic diagnostics. Short AI dialogue turns continue using the existing local ASR/TTS. The server-side AI gateway explicitly allowlists the HTTPS endpoint; credentials stay in the existing private token file. School AI enablement is checked before submission and during processing. No account name, school name or pupil ID is included in multipart metadata. Raw voice inherently can contain identifying speech and is not claimed to be anonymised; the recording UI tells learners to avoid personal identifiers. Known identifiers in subsequent text-feedback prompts are redacted through the existing gateway. Audio/content is not logged.

The owner requested this self-hosted integration. r39 processing files are erased after retrieval/cancellation, with durable retry for unconfirmed erasure and the r39 absolute 60-minute expiry as an outage bound. Reports and school recordings use the existing school retention/access controls. A job success is not teacher calibration; numeric pronunciation marks remain null. No external speech provider, model training or content retention for training is enabled. Each school deployment remains separately provisioned in Hong Kong. The public demo contains synthetic accounts only and must not receive real pupil data.

### School Google Workspace / Microsoft 365 sign-in — 24 September 2026

Optional OpenID Connect integrations use Google Workspace (Google) and Microsoft Entra ID / Microsoft 365 (Microsoft) solely to verify school staff identities. The browser visits the provider; the provider receives the school application identifier, callback address, protocol nonce/state and ordinary connection metadata. The school backend exchanges a one-time authorization code and receives signed identity claims. LearnSys stores only the provider/issuer, immutable subject or Microsoft object ID, its existing school account link and login time; it does not keep provider access/refresh tokens, profile images or directory contents. Google checks verified email plus an approved Workspace domain; Microsoft requires a school-entered immutable object-ID link. School roles are never accepted from arbitrary token claims.

Activation requires a dedicated school server, that school's OAuth client secret in its protected environment, a configured Workspace domain or Microsoft directory, and an explicit provider approval entry. The public demo cannot activate these providers. Provider authentication necessarily contacts Google/Microsoft services; do not describe it as wholly local or guarantee Hong Kong residency for provider processing. The school must review its existing Workspace/Microsoft contract and notices before activation. Local protocol tests validate signatures, issuer/audience/nonce/state, expiry and school scope with fictional tokens; real provider credentials and school sign-off remain external deployment dependencies. No new processor was activated on the public demo.

可選的 Google Workspace 及 Microsoft 365 登入只用作核實學校教職員身份。學校保留固定身份識別碼、現有帳戶連結及登入時間，不保留供應商存取憑證、相片或整個目錄。Google 須驗證電郵及 Workspace 網域；Microsoft 須由學校連結使用者物件識別碼。登入權限仍由學校管理，不以外來聲明自動提升權限。啟用前須完成專屬伺服器、學校憑證及供應商批准。供應商驗證會連線至 Google 或 Microsoft，不能視為全部在香港或本機處理；學校須審閱其服務合約及私隱通知。公開示範不啟用此等供應商。

## 2026-10-12: native consumer maths and optional school maths / 原生個人及可選校本數學

The inspected Android and native SwiftUI consumer apps target the existing iGears endpoint `https://ad55.igears.org/mathandroid`. Guest identifiers, submitted problem/working text and grade/language reach this service; Android can explicitly request compressed-photo cloud recognition and sends Google Play purchase tokens. Native iOS uses on-device Apple Vision and local StoreKit entitlements; its server transaction-verification integration remains a release dependency. This review did not inspect the consumer API's upstream AI/cloud-recognition provider, physical host or server retention. Existing Android local-photo 24-hour removal statements do not establish upstream deletion. Confirm these existing service terms before a new signed release; do not send school records to the consumer tutor.

Google ML Kit is an existing Android OCR dependency. Its [official Android disclosure](https://developers.google.com/ml-kit/android-data-disclosure) identifies SDK device/app information, installation identifiers and feature/performance diagnostics used for diagnostics and usage analytics. On-device image recognition does not imply zero SDK telemetry. Google Play and Apple process purchases under their store terms; the app does not receive payment-card details. Native iOS uses no Google ML Kit dependency.

School maths uses the existing `packages/ai` iGears self-hosted provider allowlist. No new external provider was activated. `math_school_ai` and core school AI/budget policy must both permit use; defaults remain off. Known school identity values and identifier patterns are redacted before bounded question/working/topic content is processed. The gateway requires no-training, zero-retention and `store:false` controls; metering contains feature/count/cost/latency, without prompts/responses. This is a configured/requested control, not independent proof of provider logging, training or physical residency. The school must confirm the actual Hong Kong/school hosting and processing policy before real-pupil activation. Student hints only select reviewed candidates; AI-created questions and proposed marks need human approval.

已檢視的 Android 及原生 SwiftUI 個人版連接現有 ad55 LearnSys 服務，處理訪客識別碼、提交文字、年級及語言；Android 可主動要求雲端相片辨識及核實 Google Play 憑證。原生 iOS 以本機 Vision 辨識及 StoreKit 本機權益處理。本次未檢視個人 API 的上游供應商、實際託管及伺服器保留；本機相片移除不代表上游刪除。Google ML Kit 的正式披露包括裝置／應用程式資料、安裝識別碼及功能／效能診斷，並非完全沒有 SDK 遙測。校本數學沿用獲准的 iGears 閘道，預設停用 AI，須同時通過校本數學及核心 AI／預算控制；遮蔽識別資料、禁止訓練、零保留及不記錄內容等設定不能代替實際託管及處理條款確認。沒有啟用新的外部 AI 處理者。