// Trust & Security Report
Kahoot! AS
Kahoot! Learning and Engagement Platform
Certifications held
10
Maturity
Enterprise
Trains on your data
No
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on trust.kahoot.com“In addition, Kahoot! is ISO 27001 certified, the recognized international standard for information security management systems.”
Verify on trust.kahoot.com“1Edtech Certified for both data privacy and LTI linking, assignment and grade services”
Verify on trust.kahoot.com“Kahoot!'s platform and products have also earned the Common Sense Privacy verified seal having successfully completed the vigorous independent rating process.”
Verify on trust.kahoot.com“Kahoot! provides schools and educators with tools and protections designed to support compliance with: the Family Educational Rights and Privacy Act (FERPA), the Children's Online Privacy and Protection Act (COPPA), the General Data Protection Regulation (GDPR)”
Verify on trust.kahoot.com“We comply with applicable privacy laws, such as the EU's General Data Protection Regulation (GDPR), the UK GDPR, the Family Educational Rights and Privacy Act (FERPA)”
Verify on trust.kahoot.com“We comply with applicable privacy laws, such as the EU's General Data Protection Regulation (GDPR), the UK GDPR, the Family Educational Rights and Privacy Act (FERPA), the Children's Online Privacy Protection Act (COPPA)”
Verify on trust.kahoot.com“the California Student Online Personal Information Protection Act (SOPIPA) and other US state education privacy laws”
// Privacy & AI training
Trains on customer data
No
Data processing agreement
Offered
Data region
Long-term storage of personal data is hosted on servers in the EU and Canada (primary). Additional regional processing nodes in USA, Australia, and Japan for performance optimization. Sub-processors include AWS Europe (Luxembourg), Google Cloud EU/Canada (Dublin), Aiven (Finland), OVH Canada, and Hetzner (Germany).
Trust center explicitly states: 'We don't use end user data to train AI.' AI features page confirms: 'No data from the Kahoot! platform is used to train or refine any models.' Kahoot uses Microsoft Azure OpenAI as its primary AI provider; Microsoft assures that user data are not available to other customers or used to improve OpenAI models. AI features are opt-in and administrator-controlled.
// Security controls
Encryption at Rest
AES-256 or equivalent; customer data encrypted with industry best practices in production environment.
trust.kahoot.comEncryption in Transit
TLS v1.2 or higher for all network communication; SSL implementation rated 'A' by Qualys SSL Labs.
trust.kahoot.comPenetration Testing
Continuous penetration testing conducted by an independent third party; detailed written report issued annually and available to enterprise customers on request.
trust.kahoot.comBug Bounty / Vulnerability Disclosure
Responsible disclosure program via security@kahoot.com, with safe harbor for compliant researchers. Kahoot works with Intigriti for continuous bug bounty testing. No monetary rewards offered. Full policy at kahoot.com/disclosure-policy.txt.
kahoot.comBackups
Multiple backup strategies; all backups encrypted and stored at separate geographic locations; retention up to six months.
trust.kahoot.comSecurity Policy Review
Security policies reviewed annually and approved by senior management.
trust.kahoot.comData in Dev/Test Environments
Development environments never use real customer data.
trust.kahoot.comData Transfer Mechanism (Cross-Border)
Standard Contractual Clauses (SCCs) used for transfers outside EU/EEA/UK. All sub-processors outside those regions must sign SCCs.
trust.kahoot.com// Products & data scope
data: Minimal data collected. Students who join via PIN require only a nickname (no account, no email). Teacher accounts collect contact details, usage data, and student progress. No third-party ads, no profiling for advertising.
FERPA, COPPA, SOPIPA, GDPR compliant. Common Sense Privacy and 1EdTech certified. Subscription from $3/mo. Free tier available.
data: Professional user data including employee contact details, engagement metrics, presentation analytics. SSO, roster sync, and data deletion controls available. Enterprise Agreement replaces standard T&C.
SOC 2 Type II and ISO 27001 apply here. DPA available. Annual pen test report provided to enterprise customers. Pricing from $19/mo; enterprise pricing negotiated.
data: Similar to the school product but with institutional licensing. FERPA and GDPR controls apply. LTI integration (1EdTech certified) for LMS connectivity.
Student data processed as a processor on behalf of institution.
data: Children's plans restrict group features and social sharing. No ads. PIN-based participation does not require personal data from child players.
COPPA compliant. Children's Privacy section in Privacy Notice.
data: Separate products for mobile employee engagement and company communications. Data scope governed by enterprise agreements.
Listed as 'For Businesses' solutions on kahoot.com. Separate product line from core Kahoot.
data: Separate product for classroom whiteboard collaboration. Integrated into the Kahoot school ecosystem.
Available under 'For Schools' on kahoot.com.
data: Standalone mobile language learning app. Consumer product with its own data practices.
Listed under 'For Students' and 'For Family and Friends' on kahoot.com.
// What to watch
- Bug bounty program is a VDP-style responsible disclosure (no monetary rewards); researchers submit to security@kahoot.com or via Intigriti; confirm scope before assuming full bounty payout.
- FedRAMP certification appeared in one third-party summary but is NOT listed on Kahoot's own trust center and should not be listed as a held certification without vendor confirmation.
- Data transfers outside EU/EEA/UK are possible (e.g., US/Australia/Japan nodes); mitigated by SCCs. Relevant for customers with strict EU data residency requirements.
- Drops and Whiteboard.fi are separate subsidiary products with potentially different data practices; enterprises should review those policies independently.
// At a glance
Pricing model
Freemium + subscription tiers. Individual from $3/mo; Business from $19/mo. Enterprise pricing negotiated via sales. Free tier available with limited features.
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Kahoot! AS's own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-06-27. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
trust.kahoot.com