Security & privacy

Student names, IDs, dates of birth, notes and report text are encrypted with AES-256-GCM before they reach the database, on top of the hosting provider's encryption at rest and TLS in transit.

Every student, report, edit and assessment result belongs to one provider account, and every query is scoped to it. If you work through an agency account, the agency's owner and admins can view and export the reports of the providers in their agency and see usage; nobody outside your agency can.

Passwords are hashed with scrypt. Sessions use random tokens stored only as hashes, secure HTTP-only cookies, and expire automatically. Sign-in is rate limited.

Past reports you upload are read in memory. We keep only what's needed: extracted details for the new report, and for style learning, text with student names and IDs removed (encrypted).

AI receives only what a report needs (first name, grade, areas, your notes), never last names, IDs or dates of birth, and nothing you enter is used to train AI models.

Delete a report, a student (with every report and result), or your whole account at any time. Download everything as JSON whenever you like.

Sign-ins, exports and deletions are logged without student data, so suspicious activity can be investigated.

Strict security headers (CSP, HSTS, frame protection), same-origin checks on every write, no caching of student pages, and least-privilege configuration.