Security
Careful by design.
We would rather tell you plainly what is in place, and what is not yet, than hand you a badge.
What is in place
| Data isolation | Each school's data is separated by Postgres row-level security, enforced inside the database, so one school's query cannot return another's rows. |
|---|---|
| Sign-in | Passwords are salted and hashed; accounts lock after repeated failures; optional two-step sign-in; single sign-on available on request. |
| Access control | Role-based permissions checked on every request, including delegated administration with guard rails. |
| Encryption | Traffic is encrypted in transit through Cloudflare. Staff evaluations and linked-account tokens are encrypted at rest. Backups are encrypted. |
| Audit trail | An append-only record of sign-ins, edits, and administrative actions for every school. |
| Backups | Encrypted daily backups with automated restore checks. Offsite backup copies are being enabled. |
| Network | The application is not exposed directly to the internet. It connects outbound through a Cloudflare tunnel, behind Cloudflare's DDoS and bot protection. |
| Student data | Not collected. The product is designed for staff and curriculum, and the terms prohibit entering student records. |
What we have not done yet
Scriptorium is new. We have run extensive automated tests, including cross-school isolation, permission, and injection checks, but we have not yet had an independent penetration test, and we do not hold SOC 2 or similar certifications. An outside test is planned before we scale up, and we will share a summary of results with customers.
Subprocessors
We use a small number of providers to run the service. The current list is always at the subprocessor page, and we notify school administrators before adding a provider that handles school data.
Reporting a vulnerability
If you believe you have found a security issue, email [email protected]. Please give us reasonable time to fix it before disclosing it publicly, and do not access other people's data. We will acknowledge your report promptly and will not pursue good-faith research.
Questions from your IT director
We are glad to answer security questionnaires and review a data-processing agreement. Contact us.
Bring your curriculum home.
See Scriptorium with your own courses, your own mission, and your own people. Thirty minutes, no pressure.