Two halves, one rule
Each university has its own node: the portal, its database and its documents. The ErasmusPath platform, run by us in the EU, holds the analysis and the subject catalogue. The rule between them is simple: personal data never leaves the node.
Your university's node
On your servers, or hosted for you in isolation
- Student and staff accounts
- Learning agreements and their signatures
- Transcripts and documents
- Grades and grade conversion rules
- EWP exchanges with partners
- Audit logs
What crosses
- Degrees and subjects
- Transcript text, redacted on your node
- Node version and health
- Aggregated counters
What never crosses
- Names, ID numbers and birth dates
- E-mail addresses and phone numbers
- Documents and student records
ErasmusPath platform
Run by us in the EU
- Equivalence proposals
- Subject recommendations
- Transcript analysis, in memory
- The global subject catalogue
- Licences and service status
Partner universities
Mobility data travels over Erasmus Without Paper, node to node, never through our platform.
Every call your node makes
This is the complete list. Every call goes over HTTPS, from your node to the platform, authenticated with your node's own key. None of them carries personal data.
| Call | When | What it carries |
|---|---|---|
| Enrolment | Once | The one-time enrolment code, the node's public key, its version and its name |
| Token and licence | Every 10 minutes | An assertion signed by the node; the answer is a short-lived token and the signed licence |
| Heartbeat | Every 15 minutes | Node version, health of its services and aggregated counters. Never lists, names, e-mails or identifiers |
| Recommendations | When someone asks | The search text, the home and host universities and degrees, academic year, semester and credits |
| Equivalence proposals | When someone asks | The request text, the universities and degrees, academic year, course year and semester |
| Transcript analysis | When a transcript is processed | Transcript text redacted on the node, its language and country, and the subjects of the home degree. Processed in memory, never stored |
| Catalogue synchronisation | Daily, and on request | University identifiers and the date of the last update received |
| Catalogue refresh | When staff ask | The university (and optionally degree) to crawl again |
Between universities, mobility data travels over Erasmus Without Paper, node to node. It never passes through the platform.
How your node proves who it is
Its own key
The node generates an Ed25519 key pair at enrolment. The private key never leaves your server, except encrypted inside your own backups.
Short-lived, bound tokens
Access tokens last ten minutes and are bound to the node's key with DPoP proofs, so a stolen token is useless elsewhere.
A signed licence
The platform signs a licence that the node checks offline. There are no shared passwords between your node and our platform.
Never locked out of your own data
Platform outages
The licence is valid for seven days. During an outage your node keeps working; only the platform features wait.
End of an agreement
Suspension or termination switches the node to read-only mode. Reading and exporting keep working.
Planned maintenance
Announced at least 72 hours ahead on the status page, in your node and, if you want, by e-mail.
Hosted nodes are isolated
When we host your node, it is the same software as a self-hosted one, run in its own compartment.
- Its own containers, networks and volumes, including its own database
- Its own generated secrets, enrolment key and EWP keys
- Its own encrypted backups, with a passphrase unique to your node
- A shared proxy that terminates TLS without access to the container runtime
- When the agreement ends, a full encrypted export for your university
Releases you can verify
Signed images
Every release image is signed with Sigstore cosign and recorded in its public transparency log.
SBOM and provenance
Each image carries a software bill of materials (SPDX) and SLSA build provenance.
Verified before running
The installer verifies every image by digest before it starts, and refuses anything unsigned.
Safe upgrades
Upgrades take a full backup first and roll back by themselves if anything fails.
Accountability
Audit logs on your node
Sign-ins, approvals and changes are recorded on your node and stay there.
Operator audit on our side
Our staff sign in with a password and a one-time code. Every change to a client, with its reason, is logged.
Encrypted backups
Node backups are encrypted with AES-256 using a passphrase that you keep outside the server.
GDPR roles
| Who | Role | Which data |
|---|---|---|
| Your university | Controller | Personal data of students and staff in your node |
| ErasmusPath, when hosting your node | Processor, under a data processing agreement | The personal data in your hosted node, which we run but never use |
| ErasmusPath platform | Processor, under the same agreement | Redacted transcript text, processed in memory and never stored |
| ErasmusPath website | Controller | Demo requests sent through this site, deleted 12 months after they are closed |
Sub-processors
We use a small number of providers to run the platform and hosted nodes. All of them process data in the EU.
| Purpose | Data they receive | Provider |
|---|---|---|
| Cloud infrastructure in the EU | The platform and, for hosted clients, their nodes | Named in your data processing agreement |
| AI models with EU data residency | Course data only: subject descriptions and search text | Named in your data processing agreement |
| Transactional e-mail | Institution contacts, for maintenance notices | Named in your data processing agreement |
Compliance
Designed to meet the requirements of Spain's National Security Framework (Esquema Nacional de Seguridad, ENS). ErasmusPath is not ENS-certified.
The portal is designed to meet WCAG 2.2 level AA.
Reporting a vulnerability
If you believe you have found a security problem, please tell us privately before disclosing it.
Ask through the demo request form for a private contact, and do not include details of the problem in that first message. Request a demo