Trust & security

Built to align with FERPA. Student records are scoped to their class and are visible to the student and their instructor, and available for export at any time. Student-initiated deletion becomes available once the class has ended, so an education record stays intact while the class is in session. Institutional data-processing agreements are available on request.

No targeted advertising and no sale of student data. Aligned with student online personal information protection statutes.

We do not sell or share personal data. Data-subject requests are self-serve in-product: any user can export their own data (access & portability) at any time and delete it (erasure) from Account & data settings. For students, erasure becomes available once every class they have submitted coursework in has ended — deferred, not refused, because coursework in a class still in session is a live academic record the institution must retain. Export is never deferred, and requests on a different timeline can be made through our contact page. A formal records-of-processing document and a Data Processing Agreement for institutions are available on request. One gap we will name rather than gloss: we do not yet ask for cookie consent before loading product analytics, so visitors from the EU and UK are not given that choice today. See “Cookies and analytics consent” below.

We do not sell or share personal information. Consumers can exercise their right to know (self-serve data export, always available) and right to delete (self-serve account deletion) directly in Account & data settings. For students, deletion becomes available once every class they have submitted coursework in has ended, so an active academic record is not destroyed mid-term.

A data-privacy rider for New York institutions is in preparation for our New York pilot.

Not built yet, and we would rather say so than imply a choice we do not offer. Product analytics (PostHog) loads on every page, including before you sign in, and sets a cookie plus browser storage to recognise a returning browser. There is no consent banner, so analytics is not gated on consent for EU or UK visitors. What we do not do: no advertising or cross-site tracking pixels, no sale or sharing of data, and no conversation content in analytics. A consent gate is committed work.

Sympos is built for higher education and is not directed to children under 13.

Not yet started. We will display this as complete only once an independent auditor has issued a report, never before.

On our longer-term roadmap; revisited after SOC 2.

Payments are handled entirely by Stripe (SAQ-A). Card data never touches Sympos’s servers.

A third-party penetration test is planned. We will publish the date once it is completed; the report is available under NDA.

All traffic is served over TLS.

Application data is encrypted at rest by our infrastructure providers (Supabase, Vercel).

Authentication is handled by Clerk. Every API request is authenticated and authorized with per-user and per-class ownership and enrollment checks across all routes.

Isolation is enforced at the application layer on every route: each query is scoped by user and by class membership. Database-level row-level security is a future defense-in-depth hardening on our roadmap.

Accessibility is an active effort. Our public pages and the core student conversation and assignment flows are built to WCAG 2.1 AA practices: a keyboard skip link, visible focus indicators, reduced-motion support, labeled form controls, and AA-contrast color. We are extending that same bar across instructor and administrative surfaces before we self-attest full AA coverage.

We publish the full list of the sub-processors we rely on, below.

We provide a security contact and welcome good-faith security reports. See “Report a vulnerability” below.

Conversations are sent to AI providers solely to generate responses and evaluations for your class, never to train their models. We are confirming each provider’s data-retention terms in writing.

Not done today. When a conversation is sent to an AI provider to generate a response or an evaluation, it is sent as written: we do not strip or mask names or other personal details from it first. Redaction before the model call is on our roadmap. We are not claiming zero retention or end-to-end encryption, because neither is true.

Databases are backed up by our infrastructure provider. A documented, tested disaster-recovery policy is in progress.

Self-serve in-product: from Account & data settings, any user can export their own data as a JSON download at any time, and delete their data. Deletion anonymizes and purges your personal information and content; de-identified academic records (grades and scores) are retained, unlinked from your identity, so class analytics and grading integrity stay intact. Timing: if you have submitted coursework in a class, deletion becomes available once that class has ended — the settings page names any class still in session. Export is never gated, and we handle off-cycle deletion requests through our contact page.

Formal uptime monitoring and a public status page are on our roadmap.

Instructor access to student records — the class gradebook, per-assignment student submissions, and class insights — is recorded to an audit log, along with roster changes (students joining, being enrolled or imported, and unenrolling).