Security at Studyfin
Studyfin serves children, families, schools and learning centers — so protecting the data you trust us with is foundational, not an afterthought. This page describes how the platform is built and the practices we hold ourselves to. We aim to be plain and honest here: it reflects our real posture today, and where we say something is on our roadmap, we mean it is not done yet.
Infrastructure & encryption
Google Cloud & Firebase
Studyfin runs on Google Cloud Platform and Firebase — Hosting, Firestore and Cloud Functions — inheriting Google's hardened data-center and network security.
Encrypted in transit
All traffic is served over HTTPS/TLS. Data moving between your browser and Studyfin is encrypted end to end.
Encrypted at rest
Data stored in Firestore and Google Cloud is encrypted at rest using Google-managed encryption.
Card data never touches our servers
Processed by Stripe
All payments are handled by Stripe, a PCI-DSS Level 1 certified provider. Card details are sent directly to Stripe from your browser.
We don't store card numbers
Studyfin never stores full card numbers. We keep only the references Stripe returns so you can manage your own billing.
You stay in control
Center and school admins manage billing, seats and cancellation themselves — no card data ever passes through us.
Authentication & sign-in
Firebase Authentication
Identity is managed by Firebase Authentication, so we rely on a battle-tested auth system rather than rolling our own.
SSO for staff & parents
Coaches, teachers and parents sign in with Google or Microsoft single sign-on — no separate Studyfin password to leak.
Child-friendly access
Younger students sign in with a Student ID and PIN, a simpler flow designed for kids. Sessions persist securely between visits.
Least privilege, verified on every request
Every request is checked on the server before it can touch data. We assume nothing based on the client alone.
- Least-privilege checks run server-side on every request — the client is never trusted to enforce access.
- Ownership verification guards against IDOR: we confirm the requester actually owns or is entitled to a record before returning it.
- Firestore security rules enforce tenant isolation so one school or center can never read another's data.
- Rate limiting protects sensitive endpoints against abuse and brute-force attempts.
- Audit logging records administrative actions taken in a school or center for accountability.
Student data, handled with care
Data minimization
We collect the student data we need to run the learning experience — and try not to collect more than that.
Parents in control
Parents and guardians control their child's account. For children under 13 we use a parental-consent flow, in keeping with COPPA.
How we use AI safely
- Educational content is generated using Google's Gemini API.
- Prompts are used to generate learning content — lessons, questions and explanations.
- Generated content passes through content-safety and sanitization checks before it reaches a student, so we catch unsafe or malformed output.
Where we stand — stated honestly
We'd rather be accurate than impressive. Here is exactly where our compliance efforts stand today.
- SOC 2 — in progress. A SOC 2 program is on our roadmap. We are not yet SOC 2 certified and do not claim to be.
- FERPA, COPPA & GDPR — principles we design toward. We build with these frameworks in mind and align our practices to them. We describe these as design principles, not as certifications we hold.
- Data Processing Addendum (DPA) — available on request. Schools and centers that need a DPA can request one from us.
Found something? Tell us
If you believe you've found a security vulnerability in Studyfin, we want to hear from you. Please report it to us privately and give us a reasonable chance to fix it before any public disclosure.
We will acknowledge good-faith reports, investigate promptly, and work with you in good faith to resolve valid issues. We appreciate researchers who help keep students and families safe.
Learn more
Explore how we think about trust, privacy and your rights.