Security Overview
Updated October 27, 2026
Controls in the application
Signed HttpOnly sessions, secure production cookies, hashed password and recovery verifiers, recovery throttling, same-origin write checks, non-cacheable API responses, and class-level authorization protect application access. Students access their own academic records. Teachers access assigned classes. Operational owner access spans classes; academic records still require the current teaching relationship; separate privacy grants limit campus and district reviewers to their assigned organization.
Administrative accountability
For existing school and home workflows, audit records cover privacy requests, exports, holds, deletions, account registration and recovery, teacher access changes, teacher-issued recovery, and school privacy configuration changes. This is not a claim that every action in every account type is logged; the separate personal tutoring authentication flow does not write these school privacy-audit events. The application log is not immutable and is not a complete FERPA disclosure log. Do not place student work or passwords in authorization references.
Providers and AI
Hosting uses OpenAI Sites and Cloudflare Workers/D1. Exact provider contract terms, support access, subprocessors, data locations, backup retention, and incident deadlines require confirmation before school approval. An optional writing-feedback route exists and is disabled unless its server configuration is explicitly enabled. Teacher assignment grades are entered and released by the teacher; grading does not call an AI provider. Any enabled AI feedback must minimize inputs and cannot use identifiable records for advertising, commercial profiles, or unrelated training.
Incident response
Report suspected exposure to Kendrick Broadus at support@masteritrail.com and the school. Preserve relevant evidence, restrict affected access, investigate scope, coordinate with providers and the school, and fulfill applicable notification duties. No independent penetration test or security certification is represented.
Independent personal tutoring uses a separate signed session and checks the current account before reading or saving its own work. It does not grant school or family access. Read the personal tutoring notice for its account, export, and deletion controls.
Student records and requests