Moral and Compliance Charter

Educational AI · TokiChat · Codexplore Lab · Version 1.3 · October 2025

Publisher: Codexplore Lab
Solution: TokiChat
Version: v1.3

1. Purpose and Scope

This charter defines Codexplore Lab's commitments, as the designer of the TokiChat solution, regarding the responsible, ethical, and compliant use of artificial intelligence (AI) in the educational field, in accordance with European artificial intelligence (AI) law.

It applies to all services, experiments, and partnerships implementing AI systems for learning, training, and the creation of educational content.

The objective is twofold:

  • Guarantee respect for the fundamental ethical values of education (autonomy, equity, benevolence);
  • Ensure legal compliance with the GDPR and the European AI Act, within the framework of governance already established by Codexplore Lab's framework DPIA.

2. Guiding Principles

Codexplore Lab is committed to promoting the use of AI that is:

  • Transparent, by clearly informing users that they are interacting with an AI system;
  • Secure, by strictly limiting the collection, storage, and processing of data;
  • Supervised, by maintaining constant human intervention in educational processes;
  • Equitable, by avoiding biases, discrimination, and any form of unjustified automation;
  • Open and explainable, by promoting understanding of how AIs work among teachers and learners.

3. Governance and Responsibilities

The governance of educational AI is based on a clear chain of responsibility.

Actor Role and Responsibility
Codexplore Lab / TokiChat Responsible for deployment and guarantor of the overall compliance of the AI system in the educational context.
AI API Providers (OpenAI, Mistral, Anthropic, etc.) General Purpose AI (GPAI) model providers: responsible for the compliance of their models and associated documentation.
Partner Institutions Responsible for the local use of the solution and guarantors of GDPR compliance for the data introduced.
End-users (teachers, students) Informed about the nature of interactions with AI and aware of their rights.

Minor Users and Data Responsibility

Access to TokiChat is reserved for minors over 13 years old, in accordance with Article 8 of the General Data Protection Regulation (GDPR), the age from which a minor can consent alone to the processing of their personal data in an educational setting.

Codexplore Lab implements technical and educational prevention mechanisms (automatic filters, awareness messages, educational displays) aimed at preventing the entry or transmission of sensitive data.

However, Codexplore Lab cannot be held responsible if a user voluntarily transmits personal or sensitive information in violation of usage guidelines.

Partner institutions and teachers are encouraged to reiterate these rules of caution in their awareness campaigns.

4. AI Act and GDPR Compliance

Codexplore Lab has a global compliance framework based on a framework DPIA covering all artificial intelligence processing implemented within the scope of its educational activities.

This framework is structured around several components.

4.1 AI Usage Mapping

AI uses are classified according to their risk level, in compliance with the principles of the AI Act (educational, analytical, administrative use, etc.).

This mapping allows for the identification of processing operations falling under the "high-risk" level and for the adaptation of associated supervision measures.

4.2 Consolidated Technical Documentation

This documentation describes:

  • Data flows between users, the platform, and AI API providers;
  • The logic of the models used and the conditions for prompt processing;
  • Human supervision mechanisms ensuring that AI responses never replace pedagogical decisions;
  • Automated filtering and verification measures before any content is sent to an AI API.

4.3 Shared Framework DPIA

The framework DPIA globally assesses the risks related to the processing of educational data and defines:

  • Security, minimization, and pseudonymization measures applicable to all scenarios;
  • The framework for processing carried out within the educational scope without requiring an individual impact analysis, except for the introduction of new data categories (images, sounds, biometrics) or new purposes outside education.

4.4 Documentary Monitoring of AI Providers

Each provider is subject to a compliance sheet specifying:

  • Server location and applicable jurisdiction;
  • User data retention and usage policies;
  • Declared GDPR guarantees;
  • The level of transparency and explainability under the AI Act.

4.5 Traceability and Proof of Compliance

Codexplore Lab ensures the retention of:

  • Connection logs;
  • Incident reports;
  • Purge registers;
  • And internal audit procedures.

These elements guarantee the availability and integrity of compliance evidence in the event of an inspection by a competent authority.

5. Security, Hosting, and Integration

Data processed by TokiChat transits exclusively via secure and encrypted infrastructures, guaranteeing the confidentiality and integrity of exchanges.

Hosting complies with European standards (ISO 27001, GDPR, Data Privacy Framework).

5.1 General Principles

  • No data from TokiChat is used for training, retraining, or improving AI models, according to the policies declared by third-party providers.
  • Codexplore Lab exclusively selects APIs whose terms of use guarantee the non-exploitation of user data for these purposes, but cannot substitute for providers in effectively verifying their internal practices.
  • Each provider is subject to an updated compliance sheet, specifying public commitments related to data processing and model training.
  • Requests addressed to APIs are strictly technical, ephemeral, and limited to the processing necessary for generating a response within the educational context.

5.2 Sovereign Hosting

TokiChat is hosted by Scaleway, in data centers located in France, certified ISO 27001 and compliant with GDPR. This infrastructure guarantees the sovereignty and security of educational data.

5.3 Authentication and Identity Management

Access to services is managed via Keycloak, ensuring centralized and secure authentication. The system is interoperable with ENT, Azure AD, and LDAP, facilitating integration into school infrastructures.

5.4 Technical Architecture

  • Back-end: NestJS, providing secure REST APIs;
  • Front-end: React, optimized for desktops and tablets;
  • Logging: adapted to the school context, ensuring traceability without superfluous collection.

6. Trusted AI System

The artificial intelligence integrated into TokiChat is designed as an educational assistance system, not a substitute.

6.1 Human Supervision

AI assists, without replacing, teachers and learners. It does not perform automatic grading or evaluation.

Interactions are supervised to ensure the relevance, security, and compliance of exchanges.

6.2 Model Agnosticism

TokiChat can use various AI models (GPT, Claude, Mistral, LLaMA, etc.), depending on the client's choice or context. This multi-provider positioning promotes flexibility, technical sovereignty, and pedagogical adaptation.

6.3 Multi-filtering and Exchange Control

  • Automatic algorithmic filtering to detect and block personal or sensitive data (under development);
  • Specialized AI filters hosted in France to strengthen GDPR compliance (under development);
  • Human supervision and full traceability of conversations.

6.4 Continuous Improvement

Biases, errors, and inappropriate behaviors are monitored, evaluated, and corrected in a continuous improvement plan supervised by the governance stemming from the framework DPIA.

6.5 AI Act Alignment

Codexplore Lab is pursuing a progressive approach towards European trust standards, integrating transparency, robustness, and systematic data minimization.

7. Data, Retention, and Purge

Data transmitted to APIs are:

  • Minimized;
  • Temporary (not stored beyond processing);
  • Deleted or anonymized according to the contractual durations set by each provider.

Users can request the deletion of their interactions, in accordance with the right to erasure (Article 17 of the GDPR).

8. User Rights and Duties

Each user:

  • Is informed that they are interacting with an AI;
  • Retains the right to access, rectify, and erase their data;
  • Is encouraged to exercise critical judgment on the generated outputs.

Codexplore Lab is committed to raising awareness among teachers and partner institutions about user rights (access, rectification, deletion, opposition) and good data management practices.

This awareness is based on:

  • training modules and webinars for pedagogical and administrative teams;
  • guides and educational materials explaining the GDPR framework and transparency obligations applicable to educational AI;
  • messages integrated into the platform reminding users of their rights and good usage guidelines (under development);
  • a direct contact channel for any request to exercise rights or report inappropriate content.

These actions aim to ensure the understanding and effective application of data protection principles by all educational stakeholders.

9. Accessibility, Inclusion, and Digital Sobriety

TokiChat is designed to be accessible to all audiences and to limit its environmental footprint.

9.1 Accessibility

The TokiChat interface is designed according to the principles of RGAA 4.1, with particular attention paid to readability, navigation simplicity, and compatibility with assistive tools.

Current Accessibility. To date, TokiChat integrates:

  • color contrasts compliant with RGAA readability thresholds;
  • clear and hierarchical page structures, facilitating use by screen readers;
  • rephrasing and audio reading elements to support learners with specific needs.

Planned Improvements. Codexplore Lab is pursuing a continuous accessibility improvement approach to achieve extended compatibility with assistive technologies (screen readers, adapted keyboards, voice commands).

The next identified steps include:

  • functional keyboard navigation across all main paths;
  • the progressive addition of ARIA attributes and semantic tags in the source code to strengthen technical compatibility;
  • manual validation with RGAA/WCAG audit tools (e.g., Tanaguru, AccessiWeb);
  • user tests in an educational context with learners with specific needs;
  • the publication of an RGAA compliance register, updated as improvements are made.

9.2 Inclusion

TokiChat supports inclusive educational approaches by facilitating:

  • Individualized support for learners;
  • The promotion of autonomy and active participation;
  • The adaptation of activities to various contexts (training, specialized education, language learning).

The use of AI in TokiChat is part of an active inclusion logic, aiming to make learning more accessible and personalized, without replacing human mediation.

9.3 Digital Sobriety

  • Infrastructure hosted in France on low-carbon footprint servers;
  • Limitation of superfluous processing and transparency on energy consumption;
  • Educational impact indicators (consumption or carbon footprint) under development;
  • Energy presentation of AI providers (source: Ecologits) with usage recommendations.

10. Framed Uses and Limits

The use of TokiChat falls within a defined educational framework, supporting the mission of teaching, inclusion, and learner training.

10.1 Expected Uses

TokiChat can be used for:

  • Guided training: exploration, rephrasing, active learning;
  • Remediation: adapted explanations, individual support;
  • Structuring reasoning: hypotheses, arguments, linking knowledge;
  • Pedagogical co-construction: creation and testing of AI-assisted exercises;
  • Digital and AI awareness: development of critical thinking.

10.2 Restrictions

  • No automation of decision-making acts without human validation;
  • No processing of sensitive data (health, opinions, biometrics, etc.);
  • No use outside the educational framework;
  • No commercial exploitation or unauthorized dissemination without prior agreement.

10.3 Transparency and Responsibility

Codexplore Lab and partner institutions guarantee clear and fair communication on:

  • The purposes of the tool;
  • The models used and their limitations;
  • The principles of human supervision.

Each user can report (today by email or via a dedicated Slack channel, tomorrow via an integrated form in the interface) any inappropriate content or misuse to improve system reliability.

11. Support, Incidents, and Continuous Improvement

11.1 Support

Codexplore Lab provides getting started guides, clear documentation, and technical and pedagogical support to facilitate the deployment of TokiChat.

11.2 Incident Management

An email reporting channel allows for reporting any anomaly, security question, or data deletion request. Each incident is documented and logged to ensure traceability and GDPR compliance.

11.3 Continuous Improvement

Codexplore Lab maintains a public roadmap specifying planned developments:

  • Strengthening data filters;
  • Adding pedagogical explainability features;
  • Collaboration with CREN and CATIE for research in education and AI.

12. Revision and Dissemination

This charter comes into effect on its signature date. It will be updated according to developments in GDPR, the AI Act, and observed pedagogical practices.

13. Appendices

Codexplore Lab — Version 1.3 – Charter of Moral Commitment and Compliance (October 2025)