Security & Compliance
Atomic Anesthesia is built for educational institutions. We take student data privacy seriously and have designed our platform to meet the security standards universities require.
FERPA Compliance
We comply with the Family Educational Rights and Privacy Act (FERPA) to protect student educational records.
- Student data is never sold or shared with third parties for marketing purposes
- Institutional partners receive only aggregate, de-identified data unless explicit consent is provided
- Students can access, correct, and request deletion of their personal data at any time
- When partnering with institutions, we operate as a "school official" with a legitimate educational interest under FERPA
- Data Processing Agreements (DPAs) are available for institutional partners
Infrastructure & Certifications
Our platform is built on enterprise-grade infrastructure from providers that hold industry-recognized security certifications.
| Provider | Service | Certifications |
|---|---|---|
| Supabase | Database, Authentication, File Storage | SOC 2 Type II |
| Stripe | Payment Processing | PCI DSS Level 1, SOC 2 Type II |
| Vercel | Application Hosting & CDN | SOC 2 Type II |
| Upstash | Rate Limiting | SOC 2 Type II |
| OpenAI | AI grading, study guides, flashcard generation (API) | SOC 2 Type II |
| Google (Gemini API) | Voice Preceptor live conversation | ISO 27001, SOC 2 Type II |
| Customer.io | Account and marketing email | SOC 2 Type II |
Data Protection
- Encryption in transit: All data is transmitted over TLS 1.2+ (HTTPS enforced)
- Encryption at rest: All data stored in our database is encrypted at rest using AES-256
- No credit card storage: Payment data is processed entirely by Stripe (PCI DSS Level 1) and never touches our servers
- Data isolation: Row-level security (RLS) policies ensure users can only access their own data
- Minimal data collection: We only collect data necessary for platform operation and educational analytics
Application Security
- Authentication: Secure authentication via Supabase Auth with email one-time codes and passwords (stored only as salted hashes)
- Rate limiting: Protection against brute-force attacks on all authentication endpoints with IP-based rate limiting
- Input validation: User input is validated server-side, with Zod schemas on API routes and server actions
- Security headers: Content Security Policy (CSP), HSTS, X-Frame-Options, and other protective headers are enforced on all responses
- CSRF protection: Built-in cross-site request forgery protection via same-origin policies and server-side validation
- Content security: Lesson and media content is served through server-side routes with authorization checks, preventing direct client-side access to protected resources
- Webhook verification: Stripe webhooks are verified by signature and handled idempotently; integration endpoints require an API key
Access Control
- Role-based access: Strict separation between member and administrator roles, enforced in the application and the database
- Privilege escalation prevention: Database-level policies prevent users from modifying their own role or permissions
- Row-level security: PostgreSQL RLS policies enforce data access boundaries at the database level, independent of application code
- API authentication: API endpoints that read or change member data require authentication; the few public endpoints (such as newsletter sign-up) are rate limited
Data Retention & Deletion
- Student-initiated deletion: Students can delete their accounts at any time from Settings. Their profile is removed from the community and their posts are shown as from "Deleted User"
- Erasure on request: Remaining personal data, including copies held by our email and billing providers, is permanently erased on verified request within 45 days, except records we must keep by law
- Data export: Students can download their data as a file from Settings at any time
- Institutional offboarding: We support bulk data removal on request when an institutional partnership ends
Accessibility
We work toward WCAG 2.2 Level AA conformance and fix reported barriers as a priority. Our Accessibility Statement describes what we do, known limitations, and how students can request content in an accessible format.
- Semantic HTML with landmarks, heading structure, and a skip link
- Keyboard navigation with visible focus indicators
- Browser zoom and text resizing supported
- We will complete accessibility questionnaires for your vendor review
Incident Response
In the event of a security incident that may affect student data, we will:
- Investigate and contain the incident within 24 hours of discovery
- Notify affected institutions and users within 72 hours, consistent with FERPA and applicable state breach notification laws
- Provide a detailed incident report including scope, impact, and remediation steps
- Implement corrective measures to prevent recurrence
Vendor Assessment (HECVAT)
We support the Higher Education Community Vendor Assessment Toolkit (HECVAT) process. If your institution requires a completed HECVAT questionnaire, please contact us and we will provide a completed assessment.
We also provide Data Processing Agreements (DPAs) and documentation of our security practices to support your institution's vendor review process. The platform is an educational tool and is not designed to store protected health information; students are prohibited from entering patient-identifying information.
Questions?
For security inquiries, HECVAT requests, or institutional partnership questions, contact us at hello@atomicanesthesia.com.