Security Overview
Access control
Access is role-based (student, teacher, school administrator, site administrator) and enforced on the backend for every request.
School data isolation
Users can only access data belonging to their own school and authorised classes. Cross-school access is denied.
Encryption
Traffic is served over HTTPS/TLS. Data at rest relies on our hosting and storage providers; independent confirmation of at-rest encryption is in progress.
Secrets
API keys and secrets are held server-side only and are never exposed in frontend code.
Audit history and monitoring
Administrative and assessment actions are audit-logged. Errors are captured to an internal log that never stores raw student writing, prompts or secrets.
Backups and recovery
Encrypted backups support disaster recovery. Restoration testing is tracked in our internal readiness evidence.
File-upload security
Uploads are limited by type and size, and images are processed before AI transcription.
Incident response and updates
We maintain an internal incident-response plan and keep dependencies updated. We do not publish internal endpoints, credentials or detailed architecture.
Security testing
Independent penetration testing has not yet been completed and is tracked as an external action.