How it is built
What to check before you hand over a photograph
Shorter than a policy and more specific. If you have to sign something, read this first. The privacy questions are next door.
Signing in
An emailed link, or a password if you set one. Passwords are stored as a salted hash and never in the clear.
Forgetting a password is self-service. The sign-in screen sends a one-time link that expires in thirty minutes, and asking for one for an address with no account says exactly what it says for an address that has one. It depends on a verified sending domain: with no mail configured the offer is hidden rather than failing quietly, because a reset that cannot arrive is worse than one that was never offered.
Sessions are signed cookies, scoped to the site, and a sign-out ends them.
Where the work lives
Photographs go to private object storage with no public link; the app serves them to a signed-in member of that household or school and to nobody else. Data sits in one database per deployment, and every query is scoped by school — a rule held by a test that reads the query module rather than trusting anyone to remember it.
What the model is sent
One page at a time, with first names, nicknames and numbers for that one class so a name on a paper can be matched. Never a diagnosis, never the reason behind a scoring card, never another child's page in the same request. Provider retention is switched off.
Audit and retention
Confirming a key, editing a score, finalizing a paper and discarding one are all recorded with who did it. Each school sets a retention period; a nightly job deletes photographs and scores past it, and finalized work is kept, which is what makes a portfolio rather than a bin.
What is not done yet
Said plainly here, because finding it out later is worse — and because a stale entry on this list understates the product to the reader most likely to check.
- No third-party penetration test, and no SOC 2 report.
- No single sign-on. A school signs in with email links or passwords like anyone else.
- Billing is not switched on, so there are no card details here to protect.
- No customer-managed encryption keys, and no data residency choice: everything is in the United States.