Privacy and security
How student data is handled.
A plain summary for IT, privacy and accessibility reviewers. Where something isn't in place yet, we say so. The full review pack is available on request.
At a glance
- No roster, no records from the school. Students enroll themselves by proving they own a school email address. Their record is created only after they enter the code sent to that mailbox.
- United States hosting only. Database on AWS us-west-2 (Oregon) through Supabase. Application on Vercel, Washington D.C. region.
- Encrypted in transit and at rest. TLS 1.2 or higher on every connection, HSTS on. Encryption at rest by the database provider, plus column-level AES-256 for school email and student ID, and AES-256-GCM for Canvas tokens and mail credentials.
- One AI provider, Anthropic. No training on student data. No selling it, no advertising with it.
- No university systems required for a pilot. No SIS, no Canvas admin integration, no SSO, no roster file.
Access
- Students see only their own information. Paige's student tools don't accept another person's identifier, so there is nothing to ask for.
- Sign-in uses a 6-digit code sent to the student's school mailbox: 10-minute life, 3 attempts, rate limited per phone and per address. Only the school's exact email domain is accepted.
- The same reply is given whether or not an address is already known, so the sign-up page can't be used to check who is a student.
- Staff see only the students in cohorts they're assigned to. Crisis escalations are visible only to the student affairs role.
- Campus SSO (SAML) is built and can be turned on for a pilot, so campus MFA applies.
- One Pylor engineer has production database access, for support and incidents only.
AI and safety
- Paige says she's an AI on first contact and whenever asked.
- Crisis language is detected by fixed rules before the AI model runs. Every crisis reply includes 988 and the Crisis Text Line, and a named person at the school is alerted with a 15 minute acknowledge clock.
- Every draft reply is checked before it's sent. A claim about a student's records that isn't backed by data is replaced with a handoff to a person.
- Paige refuses and routes immigration, financial aid decisions, disability accommodations, non-crisis mental health, legal questions and grade disputes to the right office.
Texting
- Consent is recorded with the exact wording the student agreed to and the time.
- STOP ends messages immediately. Outbound nudges respect quiet hours (9 PM to 8 AM) and weekly caps.
- Every outbound text passes one send gate that checks consent and opt-out. If that check can't be read, the text isn't sent.
- Grades, GPA and financial aid figures are blocked from ever going out by text.
- The school has a kill switch that stops all outbound texts at once. Crisis replies are exempt.
Subprocessors
Every third party that can receive student data. All process data in the United States.
| Provider | Purpose | What it receives |
|---|---|---|
| Supabase (AWS, Oregon) | Database | Stored pilot data |
| Vercel | Application hosting, cookie-free analytics | Data in transit and in memory while a request runs |
| Twilio | Text message delivery | Phone number and message text |
| Anthropic (Claude) | Writes replies | The student's message and facts looked up for that reply. No training on inputs or outputs. |
| Resend | Email delivery | School email address and sign-in code |
| Clerk | Staff sign-in and SSO | Staff name and email only |
| Expo (Apple and Google push) | Alerts staff of a safety escalation | Category label and the student's phone number. No message text, no name. |
| Sentry | Error monitoring | None by design. Personal data is stripped before sending. |
Canvas and school email are connected by the student, not by Pylor. Pylor only reads from Canvas, and only reads email headers (from, to, subject, date), never message bodies. No data brokers, ad networks or other AI providers. We give 30 days' written notice before adding a subprocessor that receives student data.
Retention and incidents
- All pilot data is deleted within 30 days of the pilot ending, or sooner on request. We re-check every table, confirm nothing remains, and send a signed certificate of destruction.
- A student disconnecting Canvas or email deletes that connection right away.
- The school is notified within 72 hours of a confirmed or reasonably suspected incident involving student data, and within 24 hours of any failure in the crisis path.
Accessibility
The student experience is plain text on the student's own phone, with whatever screen reader and settings they already use. The web pages are built to WCAG 2.1 AA. Automated checks pass on the live sign-up and sign-in pages. A manual screen reader and keyboard pass is planned before any spring launch, and we'll fix any AA issue the school's accessibility review finds before launch.
Not yet in place
Stated plainly, so you read it here and not later.
| Item | Status |
|---|---|
| SOC 2 / ISO 27001 | No |
| Third-party penetration test | No |
| Vulnerability scanning program | No |
| Database row-level security (isolation is in application code) | Partial |
| Tested backup restore, defined recovery targets | Not yet |
| Forced MFA for staff accounts not on SSO | Not yet |
| Advisor desk page-view logging | Not yet |
| Scheduled in-term retention deletion | Not yet |
| Carrier registration (10DLC) for the pilot number | Not yet |
Want the full review pack? Security overview, HECVAT Lite, data flow, pilot terms with a FERPA data protection addendum, subprocessors, accessibility conformance report, AI safety, and retention and incident response. Email sunny@pylorai.com.