Security

What protects your academy’s data, and what we do not yet claim.

Every statement on this page describes a control that exists in the product today and is covered by tests or provider guarantees. Where we have not done something yet, we say so.

Hosted in the United States (Vercel edge and serverless runtime; Supabase managed Postgres and authentication) · Last reviewed September 16, 2026

Controls in place

Enforced in code, verified by tests.

Identity verified on the server

Every request resolves the signed-in identity, academy membership, and role on the server before any data is read or changed. Browser-supplied tenant or role values are never trusted. Sign-in runs through Supabase Auth, with Google sign-in available, using authorization-code flow with PKCE.

Tenant isolation at the database

Each customer table is tenant-scoped and protected by forced Postgres row-level security. Repositories are tenant-scoped in code as well, and cross-tenant and anonymous access are covered by automated tests.

Encryption

TLS protects all traffic. Databases, backups, and storage are encrypted at rest by our providers. Google Workspace tokens are additionally encrypted at the application layer with a server-only key, and the application connects to the database over certificate-verified TLS.

Human approval before effects

Schedule changes, guardian-facing messages, sensitive feedback, learning records, payments, and every external send require an authorized person’s approval. Sandbox, pending, failed, and externally executed states are shown distinctly, and a sandbox capture is never presented as a real send.

AI guardrails

Deterministic rules decide validity, authorization, and persistence; models only interpret and draft. Inputs are minimized before leaving our systems (first names only, contact details and sensitive numbers stripped, task-scoped context). Each AI feature has its own switch, per-user rate limit, and per-academy daily budget, with a rules-only fallback and a kill switch. Model providers are contractually prohibited from training on our data.

Minimized logs, append-only audit

Request logs use a strict metadata allowlist that excludes message content, identities, tenant values, network addresses, tokens, and secrets. Business changes are written to an append-only audit trail with actor, action, and time.

Verified external events

Webhooks from Stripe, Resend, and Twilio are signature-verified and replay-protected before they change any state.

Secrets and release gate

Credentials live in the hosting platform’s encrypted environment and never reach the browser. Every release must pass type checking, the full test suite including authorization and tenant-isolation tests, dependency audit, source hygiene, and performance budgets before it can be deployed.

Data handling

Where data lives and how long it stays.

Hosting and providers

Application and database hosted in the United States by Vercel and Supabase; the full provider list with purpose and location is on the Subprocessors page.
Card numbers never reach our systems; Stripe handles payment details directly.
Raw lesson audio is not retained by default; the speech provider’s copy is deleted after transcription.

Retention and deletion

Customer data is kept for the life of the subscription and deleted from live systems within 30 days after termination on the academy’s instruction.
Backups expire on a rolling schedule within 90 days.
Academy owners can preview export scope and deletion impact inside the product before requesting either.

Not claimed

What we have not done yet.

We do not currently claim

SOC 2, ISO 27001, or any third-party certification. None has been obtained yet.
An independent penetration test. Security testing so far is internal and automated.
Compliance certification under FERPA, COPPA, PIPEDA, or any other regime. We build to support customers’ obligations; the customer remains responsible for its own compliance.

Incident response

Confirmed security incidents affecting customer data are reported to the academy’s account owner within 72 hours of confirmation, with the facts known at the time and updates as they develop.
The academy controls notifications to its families and regulators; we support them with the information they need.
The full commitment is Section 9 of the Data Processing Addendum.

Report a vulnerability

Responsible disclosure.

If you believe you have found a security issue, email usajaysim@gmail.com with steps to reproduce. We acknowledge reports within three business days and will not pursue legal action against good-faith research that avoids privacy violations, data destruction, and service disruption. Do not include student or guardian data in a report; if your finding exposes such data, describe it without copying it.

Or use the contact form