Built for districts.

TeachProof is designed to comply with the Family Educational Rights and Privacy Act (FERPA). We process teacher practice data, not student PII. No real student data enters the system — all students in simulations are AI-generated archetypes.

• No student PII is collected, stored, or processed
• Teacher practice data is owned by the teacher and their employing institution
• Data is not shared with third parties except as needed for service delivery
• Districts can request data deletion at any time

All data is stored in the United States.

• Database: Supabase (AWS us-east-1)
• Application hosting: Vercel (US edge network)
• AI processing: Anthropic Claude / Google Gemini (US endpoints)
• No data is transferred outside the United States

• Data in transit: TLS 1.3 for all connections
• Data at rest: AES-256 encryption (Supabase managed)
• Authentication tokens: JWT with RS256 signatures
• Passwords: bcrypt hashing (Supabase Auth)

• Row-Level Security (RLS) on all database tables
• Teachers can only access their own data
• Admins can access teacher data within their district only
• Service role keys are server-side only, never exposed to clients
• LTI 1.3 integration uses OAuth 2.0 with JWKS verification

• Practice session data: retained for 2 years, then auto-archived
• Account deletion: teachers can request deletion via email
• District departure: all teacher data can be exported or deleted on request
• GDPR/CCPA: right to access, correct, and delete personal data

• LTI 1.3 with OIDC authentication flow
• JWKS key rotation for token verification
• Platform registration required before launch
• Grade passback via LTI Assignment & Grade Services (AGS)
• No plaintext credentials stored — all OAuth token-based

In the event of a security incident:

• Affected districts notified within 72 hours
• Incident report provided with scope, impact, and remediation
• Contact: security@quantumlearningmachines.com

TeachProof is currently pursuing SOC 2 Type II certification. Our infrastructure providers (Supabase, Vercel, Anthropic) maintain their own SOC 2 certifications.