Data Protection
Your data is encrypted at rest and in transit, accessed only with JWT-authenticated sessions, and never cached in browser storage when it qualifies as PHI or FERPA.
- AES-256 encryption at rest
- TLS 1.2+ in transit (all endpoints)
- Supabase BAA for PHI workloads
- Row-Level Security on every table
- No PHI in localStorage (PHI_SAFE_MODE)
Consent & Identity
Nothing sensitive happens without an explicit, documented, auditable consent record. Minors get a parental path. EU participants get GDPR rights.
- Granular consent_records table
- COPPA parental consent flow
- GDPR data subject request path
- 30-minute inactivity signout
- Role-based access control
Audit & Accountability
Sensitive data operations within HIPAA and FERPA-covered tools write audit_log entries. We review internally on a quarterly cadence and publish status updates to this page.
- Immutable audit_log table
- Internal compliance audits on quarterly cadence (first full audit April 17, 2026)
- Third-party penetration test on 2026 roadmap
- Public status strip on this page
- Incident response SLA: 24-hour customer notification