Security & Trust

Last updated: October 13, 2026

This page is our public trust center for universities, firms, and security reviewers. It describes what we have shipped today — not certifications we have not completed. For the full privacy notice, see the Privacy Policy.

What we protect

Account credentials and session cookies
Model submissions, grades, and classroom roster data (including LTI-connected classes)
Hiring assessment invites, integrity signals, and recruiter analytics
Billing metadata processed by Stripe (we do not store card numbers)

Infrastructure & encryption

Application hosted on Vercel; primary database and auth on Supabase (Postgres).
Traffic is encrypted in transit with TLS. Database connections use TLS to Supabase.
Data at rest is encrypted by our cloud providers' standard disk encryption. We do not currently offer customer-managed keys.
Sensitive tables use Postgres row-level security patterns; privileged operations run through server-side service-role paths with application authorization checks.

Authentication

Email/password with a strong password policy (length and complexity requirements).
Social sign-in: Google, LinkedIn, and Microsoft (Azure AD / personal Microsoft accounts when the provider is enabled on our auth project).
Institutional SAML SSO via Supabase for domains we register with your IdP (Okta, Entra ID, Shibboleth, etc.). Setup is coordinated with your IT team — see Enterprise.
Optional TOTP multi-factor authentication for accounts that enroll it from Dashboard → Billing.

Application controls

Content-Security-Policy and related browser security headers
Rate limiting on auth, enterprise inquiry, and similar endpoints
Assessment integrity telemetry for timed hiring and class tests (away/paste/copy signals for human review — not automated fail)
Open-redirect hardening on post-login destinations
Organization workspaces with role-based access (owner, admin, instructor, recruiter, member) for firms and university programs
Security audit log for sensitive account and org actions (export, delete, member changes)

Subprocessors

We use the following providers to run the Service. We do not sell personal data.

Supabase — authentication, database, storage
Vercel — application hosting, analytics, and speed insights
Stripe — payments and customer billing portal
Resend — transactional email
Sentry — error monitoring (when enabled)

Material changes to this list will be reflected on this page. For a formal DPA or subprocessor questions, email privacy@sheetrank.com.

AI data use

Some product features may use AI-assisted grading diagnostics or coaching. We do not sell your models or classroom content for advertising. We do not use customer spreadsheet submissions to train public foundation models. Prompts and diagnostic context sent to an AI provider (when a feature is enabled) are used only to generate that response. Details and rights requests: privacy@sheetrank.com.

Compliance status (honest)

SOC 2: not yet attested. We are building toward an audit when institutional deals require the report.
FERPA: we support school-official style classroom use under our Privacy Policy and can execute a DPA on request. See Privacy § FERPA.
HECVAT / VPAT: available on request as we complete them — contact security@sheetrank.com.
SCIM 2.0: org-scoped user link/unlink API at /api/scim/v2 (see Dashboard → Organizations).

Vulnerability disclosure

Report security issues to security@sheetrank.com. Please do not file public GitHub issues for vulnerabilities. Full process: see SECURITY.md in our repository.