Security
Last updated October 13, 2026
What we hold, where it lives and who can see it. Your IT and privacy teams can ask us for the documents at the end of this page.
What your school sees
Progress in aggregate, in groups of at least ten students. Your staff cannot open a student's messages, profile or documents.
What students share
Their goals, school details, conversations with the guide, the graduates they save, and a resume or degree audit if they upload one. Course and club lists come from your school's public pages. Nothing needs to connect to your systems to start.
Student records
We treat student data as education records under FERPA and use it only to run the service for your school. We never sell it or use it for advertising.
AI
The guide's replies are written by OpenAI through its business API, which does not train on this data by default. No other AI provider receives student data.
Where data lives
The app, the database and analytics run in the United States, on Vercel, Supabase and PostHog. OpenAI handles conversations under its own business terms. Data is encrypted in transit and at rest, and every database table limits each row to the people allowed to see it.
Sign-in
Students sign in with Google or with an email and password.
Deleting data
Students can delete their account at any time. Account deletion removes active student records and sends deletion requests for linked OpenAI conversations and files. Provider security logs follow the provider's retention rules. Their analytics record is erased on request. When your school asks, we delete its students' data. Database backups age out within seven days. Private backups of uploaded documents can remain for up to 32 days after the source file is deleted.
How we build and run it
Every code change is checked before it merges, with automated tests, scans for security flaws and exposed secrets, and accessibility checks. Our team signs in to our hosting, code and database accounts with a second factor. If we find a breach that affects your students, we tell you promptly and follow up in writing within one business day.
Technical leadership and qualifications
Kaya Hickin, co-founder and CTO, holds DHS Trusted Tester certification for Web on Windows and Microsoft's Applied Skills credential in securing AI solutions in the cloud.
He has also completed U.S. Department of Education training in FERPA for colleges and universities and data sharing under FERPA, plus the Linux Foundation's Developing Secure Software course.
Documents
- Accessibility conformance report (ACR), WCAG 2.1 AA
- HECVAT questionnaire
- Subprocessor list and data flow
- Data retention and deletion policy
Ask for any of them at kaya@myfutureselfapp.com.