Trust & Security

All data in transit is encrypted with TLS 1.2+ and HSTS is enforced site-wide (max-age=31536000; includeSubDomains). Data at rest is stored on Supabase's encrypted storage volumes (AES-256).

Multi-tenant architecture with PostgreSQL Row Level Security policies. Anonymous keys cannot reach sensitive tables; service-role access is server-side only and bounded by organization scoping.

Student access via single-use OTP codes; administrator access via bcrypt-hashed passwords with role-based access control (super_admin, admin, viewer, agency owner). Multi-factor authentication for administrators is in active development.

Enterprise SSO (Clever, ClassLink, Google Workspace for Education) is on the K-12 roadmap for the next two quarters.

Administrative actions affecting student or assessment data are logged with actor, entity, IP, and timestamp. Logs are retained for accountability and FERPA recordkeeping.

Distributed rate limiting on all sensitive endpoints (OTP, login, AI calls) via Upstash Redis. Prompt-injection sanitization is applied to all user-supplied text before any LLM call.

Strict-Transport-Security, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy, restrictive Permissions-Policy. Content-Security-Policy and Cross-Origin-Embedder-Policy are deployed in report-only mode and being tuned for full enforcement.

Assessment data sent to AI providers (Anthropic, Google) is governed by their commercial API terms, which prohibit use of customer data for model training. District tenants may also disable AI processing entirely or require PII redaction before any data leaves our infrastructure.

Migration to Google Vertex AI (stronger no-training defaults) and enablement of Anthropic Zero-Data-Retention is in progress.

Application data is stored in U.S. regions. CDN edge caching may serve static assets globally; no authenticated application data leaves U.S. regions.

Students and authorized administrators can request deletion of student records. Deleted records are purged from primary storage within 90 days; backup persistence does not exceed an additional 30 days. District contract terms supersede defaults.

We maintain an incident response process targeting initial notification to affected district contacts within 24 hours of confirmed material incident, with detailed follow-up within 72 hours, in line with SDPC NDPA expectations. Formal IR runbook and tabletop exercises are part of our SOC 2 readiness work.

SOC 2 readiness is the focus of our 2026 compliance roadmap. Type I attestation targeted within the next six months, Type II observation window starting in parallel.

Built on Radix UI primitives, which are accessibility-first. A formal WCAG 2.1 AA audit and VPAT/ACR is being scheduled to meet ADA Title II district flow-down expectations (compliance dates April 26, 2027 / April 26, 2028).

Security researchers can report vulnerabilities to security@thestudentblueprint.com. See /.well-known/security.txt for machine-readable contact details.