Security Practices
How we protect student data at every layer, from the database to the AI API. Last updated: April 2026.
Infrastructure Security
Encryption in Transit
TLS 1.3 on all connections between browsers, servers, and databases. Older cipher suites (TLS 1.0, 1.1) disabled. HSTS headers enforce secure-only connections.
Encryption at Rest
AES-256 encryption for all data stored via Supabase on AWS infrastructure. Database backups are also encrypted at rest.
Row-Level Security
Database-enforced access rules (Postgres RLS). Users can only read their own rows, enforced at the query layer, not just the API.
Secure Authentication
Supabase Auth with bcrypt password hashing, secure session tokens, and optional MFA for admin accounts. Sessions expire after inactivity.
US Data Residency
All data stored in the United States (AWS us-east-1, Northern Virginia). No cross-border transfers. Student data never leaves US infrastructure.
No Client-Side PII
API keys and student PII never appear in browser-visible code, network logs, or console output. All sensitive operations are server-side only.
Application Security
Role-based access control
Students, teachers, parents, and admins each see only the data their role permits. Enforced in middleware before any page renders.
Middleware auth guard
Every protected route verifies authentication and user role server-side before responding. Unauthenticated requests return 401.
FERPA consent gate
Students must provide consent before accessing the platform. Under-13 students require verified parental consent first.
Rate limiting
API endpoints rate-limited per IP to prevent brute-force and abuse. Auth endpoints have stricter limits (5 attempts per 15 minutes).
Input validation
All user inputs validated and sanitized server-side. Client-side validation is UX only, not a security boundary.
CSRF protection
Built-in protection through Next.js server actions and Supabase Auth session token rotation.
Content Security Policy
Strict CSP headers prevent XSS. Inline scripts blocked. Trusted sources allowlisted only.
Dependency monitoring
npm audit and Dependabot alerts on all dependencies. Critical security patches applied within 48 hours.
AI Privacy Controls
Gregarious uses the Claude API (Anthropic) for Socratic tutoring and writing feedback. We apply strict controls to ensure no student PII reaches AI systems.
Name stripping
All student names, emails, and identifying information are stripped (lib/privacy.js) before any content reaches the AI API.
Zero-data-retention (ZDR)
Anthropic's ZDR header is sent on every API call. Anthropic does not store or train on any inputs or outputs from Gregarious.
Server-side only
All AI API calls are made exclusively from Next.js server-side API routes. The ANTHROPIC_API_KEY never reaches the browser.
Anonymized tokens
Student data referenced in AI prompts uses randomly generated session tokens, not real user IDs or names.
Prompt injection guards
Student input passed to AI prompts is sanitized and enclosed in system-level guardrails to prevent prompt injection attacks.
Audit Logging
Every access to student data is logged in our immutable audit system. School administrators can access their school's audit log at any time from the Admin dashboard.
Actor
User ID, role, and session token for every access.
Action
View, create, update, delete, or export.
Resource
Database table, record ID, and field names accessed.
Timestamp
UTC timestamp to millisecond precision.
IP Address
Originating IP (hashed for privacy after 90 days).
Retention
Account lifetime plus 3 years for legal compliance.
Compliance & Certifications
SOC 2 Type II
FERPA Design
COPPA Design
Penetration Testing
Responsible Disclosure Policy
MA Student Data Privacy (M.G.L. c.71)
SOC 2 Type II audit is scheduled for completion before the Fall 2026 district pilot launch. Results will be available to district administrators upon request.
Incident Response Plan
In the event of a security incident or data breach, Gregarious follows this six-step protocol:
Identification
Detect and confirm the incident within 4 hours. Classify severity (P1/P2/P3) and initial scope estimate.
Containment
Immediately contain the breach: revoke tokens, isolate affected systems, block suspicious traffic.
Notification (72 hrs)
Notify affected schools and users within 72 hours. Include: nature of breach, data affected, remediation steps, and a contact point.
Investigation
Determine root cause and full impact. Preserve logs. Engage legal counsel if required.
Remediation
Implement technical fixes to close the vulnerability. Update security measures and test.
Post-Incident Report
Document incident, response timeline, root cause, and lessons learned. Provide full report to affected schools within 15 days.
Breach Notification Commitment
Gregarious commits to notifying affected schools and users within 72 hours of discovering any breach that may compromise student personal information. Notification includes: the nature of the incident, categories of data affected, approximate number of records, remediation steps taken, and a direct contact for questions.
Responsible Disclosure
We value the security research community. If you have found a potential vulnerability in Gregarious, please report it responsibly. We pledge to:
Bug Bounty Program
We offer recognition and thanks for all validated security reports. Monetary bounties are planned for the post-funding phase. All valid reports will be credited publicly unless anonymity is requested.
Security questions? Email cgb003@gmail.com