Security · OutFigure

§ 1 Built

Controls in the software today

Isolation in the database Tested: Every learner-data table has row security enabled and forced. The application connects as a role that owns no tables and cannot bypass row security, and cross-project references are blocked by composite foreign keys. Scope comes only from credentials or verified membership, never from a request body.
Credentials Tested: API keys are shown once and stored only as keyed hashes. Scopes are enforced per request; a role can grant only the scopes it holds; revocation, expiry and removed memberships take effect on the next request.
Safe ingestion Tested: Request bodies are size-limited while they are read, batches are atomic, and idempotency keys prevent retries from counting twice. A success response means the data is committed.
Data minimization Built: Learners are identified only by pseudonymous IDs chosen by the platform. Events carry no names, email addresses or free text, unknown fields are rejected, and error messages never repeat submitted values.
No language-model processing Built: The core calls no language model, and no learner data is sent to one.
Repository and supply chain Built: Exact dependency versions with a committed lockfile, automated scans for secrets and advisories, and continuous integration actions pinned to specific commits.

§ 2 Scope

Not in place yet

Real learner data is not accepted until each of these exists and has been tested.

A hosted service with verified operator sign-in
Rate limits and daily quotas
Learner export, erasure and deletion tombstones
Retention jobs
Encrypted backups with a rehearsed restore
An independent security review. No SOC 2 or ISO 27001 audit has been performed.

§ 3 Reporting

Reporting a security issue

Please use the contact details on the Company page, and do not include real personal data in reports. A dedicated security contact will be published before the hosted sandbox opens.