Security

All traffic is served over HTTPS/TLS. The database enforces row-level security on every application table, so each user can only read their own rows; the privileged database functions that back roster and admin views run with a fixed, non-overridable search path, and administrative access is role-gated and audit-logged. Permission and quota checks run on the server, not just in the browser, so they cannot be bypassed by a modified client.

Our AI endpoint requires a valid authenticated session, restricts cross-origin access to an allowlist of known origins, and applies per-user rate limits (per-minute, per-hour and per-day) to contain abuse and runaway cost. Every response carries an enforcing Content-Security-Policy — arbitrary JavaScript eval is blocked (only the in-browser ML model's WebAssembly compilation is permitted), framing is restricted, and violations are reported to a monitored endpoint. Alongside it we send HSTS with preload, nosniff, a strict referrer policy, a restrictive Permissions-Policy, and Cross-Origin-Opener and Resource policies.

Dependencies are scanned for known vulnerabilities and patched; advisories in our runtime dependencies are kept resolved. The application is hosted on Lovable Cloud (built on Supabase and Cloudflare); platform-level certifications and compliance details for that infrastructure are published at trust.lovable.dev.

You can export or permanently delete your data at any time from Settings. Educator batch submissions are purged automatically after 180 days and usage telemetry after 400 days. Deleting your account cascades to erase your profile, analyses, usage history, settings and submissions.

We rely on a small set of vetted sub-processors for hosting, database, and AI processing, listed on the Sub-processors page. Student and customer content sent for AI processing is covered by contractual no-training terms.

We are actively working toward: SSO/SAML for institutions, independent penetration testing, and a SOC 2 examination. These are not yet complete — we will update this page as each lands rather than claim them prematurely.

Our vulnerability-disclosure policy is published, per RFC 9116, at /.well-known/security.txt. If you believe you have found a security issue, please email [security@your-domain] with details and steps to reproduce. Please do not publicly disclose until we have had a reasonable chance to remediate. We appreciate responsible disclosure.