Trust & security

Built to align with FERPA. Student records are scoped to their class and are visible to the student and their instructor, and available for export or deletion on request. Institutional data-processing agreements are available on request.

No targeted advertising and no sale of student data. Aligned with student online personal information protection statutes.

We do not sell or share personal data. Data-subject requests are self-serve in-product: any user can export their own data (access & portability) and delete it (erasure) from Account & data settings. A formal records-of-processing document and a Data Processing Agreement for institutions are available on request.

We do not sell or share personal information. Consumers can exercise their right to know (self-serve data export) and right to delete (self-serve account deletion) directly in Account & data settings.

A data-privacy rider for New York institutions is in preparation for our New York pilot.

Socrat is built for higher education and is not directed to children under 13.

Not yet started. We will display this as complete only once an independent auditor has issued a report, never before.

On our longer-term roadmap; revisited after SOC 2.

Payments are handled entirely by Stripe (SAQ-A). Card data never touches Socrat’s servers.

A third-party penetration test is planned. We will publish the date once it is completed; the report is available under NDA.

All traffic is served over TLS.

Application data is encrypted at rest by our infrastructure providers (Supabase, Vercel).

Authentication is handled by Clerk. Every API request is authenticated and authorized with per-user and per-class ownership and enrollment checks across all routes.

Isolation is enforced at the application layer on every route: each query is scoped by user and by class membership. Database-level row-level security is a future defense-in-depth hardening on our roadmap.

Accessibility is an active effort. Our public pages and the core student conversation and assignment flows are built to WCAG 2.1 AA practices: a keyboard skip link, visible focus indicators, reduced-motion support, labeled form controls, and AA-contrast color. We are extending that same bar across instructor and administrative surfaces before we self-attest full AA coverage.

We publish the full list of the sub-processors we rely on, below.

We provide a security contact and welcome good-faith security reports. See “Report a vulnerability” below.

Conversations are sent to AI providers solely to generate responses and evaluations for your class, never to train their models. We are confirming each provider’s data-retention terms in writing.

Databases are backed up by our infrastructure provider. A documented, tested disaster-recovery policy is in progress.

Self-serve in-product: from Account & data settings, any user can export their own data as a JSON download and delete their data. Deletion anonymizes and purges your personal information and content; de-identified academic records (grades and scores) are retained, unlinked from your identity, so class analytics and grading integrity stay intact.

Formal uptime monitoring and a public status page are on our roadmap.

Instructor access to student records — the class gradebook, per-assignment student submissions, and class insights — is recorded to an audit log, along with roster changes (students joining, being enrolled or imported, and unenrolling).