Built for students. Designed with their data in mind.
Scholar documents the security and privacy controls protecting the platform — including what has and has not been independently verified.
Security Snapshot
Application tables protected by row-level security
Database access policies
Public file-storage buckets
Open findings in the most recent automated security scan
Required for every administrative account on every sign-in
Production security snapshot — measured August 23, 2026
These controls are self-attested by Strategic Care Group LLC and have not been independently audited.
Student & Family Protection
Role-based access
What each account can see is determined by its role and its authorized relationships.
Secure parent/student linking
Parents connect to a student through a secure, single-use QR link rather than a shared identifier.
Private student file storage
Uploaded student work is stored privately and is not publicly reachable.
No sale of personal information
Scholar does not sell personal information.
No third-party advertising
No advertising and no behavioral advertising pixels on the student experience.
Separated student data
Student data is separated by account, role, and institution.
Private reflections stay private
A student's private AI reflections are not exposed through ordinary parent or institution progress reporting.
Academic integrity & human oversight
Scholar uses AI as a tool, not a substitute for academic judgment. Curriculum and testing decisions are informed by experienced education leadership, including a Scholar co-founder with 20 years of teaching experience and Kaplan tutoring experience. AI-generated practice content must also pass Scholar's content-integrity and validation controls before being promoted for student use.
Administrative Security
- Administrative accounts require multi-factor authentication on every new sign-in, with protected administrative operations requiring an MFA-verified session.
- Second-factor verification uses standards-based TOTP authenticator apps; authenticator secrets are managed by the authentication provider and never stored, emailed, or displayed after enrollment.
- Enforcement exists at both the interface and server layers.
- Administrative actions are logged.
- Sensitive operations execute server-side, never in the browser.
AI & Student Data
- AI credentials never reach the browser.
- Only the academic context needed for a request is sent.
- Payment data is never sent to AI models.
- Providers are not permitted to use Scholar data to train their public foundation models.
- AI conversations and history can be deleted on request.
- AI-generated estimates are guidance — not official scores or admissions decisions.
Payment Security
Card entry happens inside Stripe's hosted payment experience. Full card numbers and CVC codes do not enter Scholar's systems.
Independent Assurance Status
What Scholar Has
- Implemented security controls
- Automated security scanning
- Administrative MFA
- Audit trails
- Private storage
- Documented incident-response practices
- Documented Security & Privacy Overview (available to partners on request)
What Scholar Does Not Yet Claim
- SOC 2 Type I
- SOC 2 Type II
- Independent penetration test
- Independent security audit
- Formal privacy-counsel review
We believe transparency is more useful than claiming assurance we have not yet earned.
Security Roadmap
- Administrative MFA
- Independent penetration test
- Privacy-counsel review
- Formal written security-policy set
- Scheduled backup/restore exercises
- SOC 2 Type I → SOC 2 Type II
Scholar's Security & Privacy Overview is self-attested by Strategic Care Group LLC. Scholar does not currently hold a SOC 2 Type I or Type II report, and no third-party penetration test has been performed. See the full disclosure for current assurance status.