How We Keep Your Data Secure

AE4 is built for a school setting, so protecting student information is a core part of the design — not an afterthought. This page summarizes the safeguards in place.

Data isolation

Every student’s records are isolated at the database level using row-level security. A student can only ever see their own data; teachers can only see students in their own classes; administrators oversee the program. These rules are enforced by the database itself, not just the app screens.

Tamper-proof grading

Quiz and mastery scores, and competency levels, are calculated and written on the server using a privileged key that never reaches the browser. Students have no way to change their own grades, and answer keys are never sent to the browser.

Least privilege & role protection

Accounts are Student, Teacher, or Administrator. Roles cannot be self-assigned — a database safeguard blocks any attempt by a user to grant themselves higher access or approval. Teacher and administrator grade changes are recorded in an audit log.

No student names in curricula

Generated curricula contain no student names or personal information, so learning content can be shared and reused across classes without exposing anyone’s identity.

Encryption

All traffic between your device and the Service is encrypted in transit (HTTPS/TLS). Data stored by our database provider is encrypted at rest.

Authentication

Accounts are managed by a dedicated authentication provider. Passwords are stored only in hashed form, and everyone can securely reset their own password by email.

Responsible AI data handling

When AI is used to generate curricula or assess work, only the necessary inputs are sent to our AI provider (Anthropic) via its API, which does not use that data to train its models.

Trusted providers

We rely on a small set of established providers — Supabase (database & authentication), Anthropic (AI), and Railway (hosting) — that process data only to operate the Service.

Privacy posture

We minimize the data we collect, use it only to run the Service, never sell it, and never use it for advertising — consistent with a FERPA/COPPA-aware approach and directed by the school.

Security questions or reports: [email protected].