Security

• Sign-in is handled by Clerk, a specialist authentication provider. We never see or store your password.
• You can turn on two-factor authentication with an authenticator app in Settings › Security. We recommend it.
• Sign-up has automated bot protection, and disposable email addresses are blocked.
• Requests for account data are checked against your signed-in session, so you can reach only your own data — or, on a team plan, what your role in the team allows.

• Encryption in transit: our sites are served over HTTPS only (TLS 1.2 or higher), and browsers are told never to connect to them without it (HSTS).
• Encryption at rest: our databases, file storage and queues on Amazon Web Services are encrypted at rest.
• Private storage: files you upload are kept in storage that blocks public access and are shared only through short-lived links that expire within minutes.
• Payments: card details are entered directly into Stripe and never reach our servers.
• AI: common identifiers such as email addresses and phone numbers are removed from your tutor questions before they are sent to an AI model. See our AI Policy.

• EducationPals runs on Amazon Web Services in the United States (Oregon region).
• Each part of the system gets only the permissions it needs — for example, the AI tutor may call only the specific AI models it uses.
• A web application firewall and rate limits protect our APIs from abuse and floods of traffic.
• Our web pages send security headers that stop them being framed by other sites, restrict which scripts can run, and limit access to your camera, microphone and location.
• Development and production are separate environments with separate data.

• Staff tools are available only to accounts we have marked as staff.
• Staff actions on learner accounts are recorded in an audit log that cannot be edited or deleted, and reading that log is itself recorded.
• Our staff tools do not show your tutor conversations, notes or answers. Access to the underlying systems is limited to the people who run the service, and used only to operate, secure and fix it, or when the law requires.
• On a team plan, team administrators see learning progress only — never tutor conversations, answers or notes. See Student Privacy.

• Our databases have continuous backups that let us restore them to any point in the last 35 days, and production databases are protected against accidental deletion.
• Application logs are kept for 90 days; privacy and audit-related logs for up to one year.
• When you delete your account, your data is erased from our live systems straight away, across every service and our analytics provider. Copies in backups expire within 35 days.
• If a personal data breach affects you, we will notify you and the relevant authorities as the law requires.

If you believe you have found a security vulnerability in EducationPals, please email legal@educationpals.ai with "Security" in the subject. Include what you found, where (the URL or feature), the steps to reproduce it and the impact you think it has. We will acknowledge your report, keep you updated while we investigate, and tell you when it is fixed. Our contact details are also published in our security.txt file.

When you research a vulnerability, please:

• use only your own accounts, and never access, change or delete other people's data — stop and report as soon as you see someone else's information;
• do not run denial-of-service tests, spam, social engineering or physical attacks, and do not use automated scanners that send large amounts of traffic;
• give us a reasonable amount of time to fix the issue before you share it with anyone else;
• follow the law.

If you act in good faith and follow these rules, we will not take legal action against you over your research. We do not run a paid bug bounty programme at the moment, but we are glad to credit you once the issue is fixed if you would like.

• Use a unique password and turn on two-factor authentication.
• Be wary of emails asking you to sign in or pay. Our emails come from addresses at educationpals.ai, and we will never ask for your password.
• Sign out on shared computers.
• If you think someone else has used your account, change your password and tell us straight away.