Trust & Security

Built for students. Designed with their data in mind.

Scholar documents the security and privacy controls protecting the platform — including what has and has not been independently verified.

Security Snapshot

120 / 120

Application tables protected by row-level security

252

Database access policies

0

Public file-storage buckets

0

Open findings in the most recent automated security scan

MFA

Required for every administrative account on every sign-in

Production security snapshot — measured August 23, 2026

These controls are self-attested by Strategic Care Group LLC and have not been independently audited.

Student & Family Protection

Role-based access

What each account can see is determined by its role and its authorized relationships.

Secure parent/student linking

Parents connect to a student through a secure, single-use QR link rather than a shared identifier.

Private student file storage

Uploaded student work is stored privately and is not publicly reachable.

No sale of personal information

Scholar does not sell personal information.

No third-party advertising

No advertising and no behavioral advertising pixels on the student experience.

Separated student data

Student data is separated by account, role, and institution.

Private reflections stay private

A student's private AI reflections are not exposed through ordinary parent or institution progress reporting.

Academic integrity & human oversight

Scholar uses AI as a tool, not a substitute for academic judgment. Curriculum and testing decisions are informed by experienced education leadership, including a Scholar co-founder with 20 years of teaching experience and Kaplan tutoring experience. AI-generated practice content must also pass Scholar's content-integrity and validation controls before being promoted for student use.

Administrative Security

  • Administrative accounts require multi-factor authentication on every new sign-in, with protected administrative operations requiring an MFA-verified session.
  • Second-factor verification uses standards-based TOTP authenticator apps; authenticator secrets are managed by the authentication provider and never stored, emailed, or displayed after enrollment.
  • Enforcement exists at both the interface and server layers.
  • Administrative actions are logged.
  • Sensitive operations execute server-side, never in the browser.

AI & Student Data

  • AI credentials never reach the browser.
  • Only the academic context needed for a request is sent.
  • Payment data is never sent to AI models.
  • Providers are not permitted to use Scholar data to train their public foundation models.
  • AI conversations and history can be deleted on request.
  • AI-generated estimates are guidance — not official scores or admissions decisions.

Payment Security

Card entry happens inside Stripe's hosted payment experience. Full card numbers and CVC codes do not enter Scholar's systems.

Independent Assurance Status

What Scholar Has

  • Implemented security controls
  • Automated security scanning
  • Administrative MFA
  • Audit trails
  • Private storage
  • Documented incident-response practices
  • Documented Security & Privacy Overview (available to partners on request)

What Scholar Does Not Yet Claim

  • SOC 2 Type I
  • SOC 2 Type II
  • Independent penetration test
  • Independent security audit
  • Formal privacy-counsel review

We believe transparency is more useful than claiming assurance we have not yet earned.

Security Roadmap

Completed
  • Administrative MFA
Near Term
  • Independent penetration test
  • Privacy-counsel review
Medium Term
  • Formal written security-policy set
  • Scheduled backup/restore exercises
Future Assurance
  • SOC 2 Type I → SOC 2 Type II

Need additional security information?

Schools, districts, and institutional partners may request additional security and privacy documentation as part of their vendor review or procurement process.

Scholar's Security & Privacy Overview is self-attested by Strategic Care Group LLC. Scholar does not currently hold a SOC 2 Type I or Type II report, and no third-party penetration test has been performed. See the full disclosure for current assurance status.