Built for students. Designed with their data in mind.
Scholar documents the security and privacy controls protecting the platform — including what has and has not been independently verified.
Security Snapshot
Application tables protected by row-level security
Database access policies
Public file-storage buckets
Critical findings in the most recent automated security scan
Open warnings from that scan, reviewed and accepted as intended behavior
Production security snapshot — measured September 5, 2026
These controls are self-attested by Strategic Care Group LLC and have not been independently audited.
Student & Family Protection
Role-based access
What each account can see is determined by its role and its authorized relationships.
Secure parent/student linking
Parents connect to a student through a secure, single-use QR link rather than a shared identifier.
Private student file storage
Uploaded student work is stored privately and is not publicly reachable.
Course and syllabus data
Uploaded syllabi, course information, assignments, and other academic materials are treated as private student academic data. They are used to provide Scholar's academic features — coursework support, writing feedback, planning, and practice — and are not published or made publicly reachable.
No sale of personal information
Scholar does not sell personal information.
No third-party advertising
No advertising and no behavioral advertising pixels on the student experience.
Separated student data
Student data is separated by account, role, and institution.
Private reflections stay private
A student's private AI reflections are not exposed through ordinary parent or institution progress reporting.
Academic integrity & human oversight
Scholar uses AI as a tool, not a substitute for academic judgment. Curriculum and testing decisions are informed by experienced education leadership, including a Scholar co-founder with 20 years of teaching experience and Kaplan tutoring experience. AI-generated practice content must also pass Scholar's content-integrity and validation controls before being promoted for student use.
Administrative Security
- Administrative pages and privileged operations require a signed-in account holding the administrator role, checked both in the interface and again server-side on every privileged request.
- Multi-factor authentication for administrators is implemented using standards-based TOTP authenticator apps, with enrollment, verification, and a documented break-glass recovery procedure. Platform-wide enforcement is not currently switched on, and it is a near-term roadmap item.
- Authenticator secrets are managed by the authentication provider and are never stored, emailed, or displayed after enrollment.
- Administrative actions are logged.
- Sensitive operations execute server-side, never in the browser.
AI & Student Data
- Scholar controls what academic context is assembled and sent to AI systems, based on the student's account, role, authorized relationships, and the specific feature in use.
- AI credentials never reach the browser.
- Only the academic context needed for a request is sent.
- Payment data is never sent to AI models.
- Providers are not permitted to use Scholar data to train their public foundation models.
- AI conversations and history can be deleted on request.
- AI-generated estimates are guidance — not official scores or admissions decisions.
Payment Security
Card entry happens inside Stripe's hosted payment experience. Full card numbers and CVC codes do not enter Scholar's systems.
Independent Assurance Status
What Scholar Has
- Implemented security controls
- Automated security scanning
- Row-level security on every application table
- Audit trails
- Private storage
- Documented incident-response practices
- Documented Security & Privacy Overview (available to partners on request)
What Scholar Does Not Yet Claim
- Platform-wide enforced administrative MFA
- SOC 2 Type I
- SOC 2 Type II
- Independent penetration test
- Independent security audit
- Formal privacy-counsel review
We believe transparency is more useful than claiming assurance we have not yet earned.
Security Roadmap
- Row-level security across all application tables
- Automated security scanning
- Administrative MFA implementation
- Enforce administrative MFA platform-wide
- Independent penetration test
- Privacy-counsel review
- Formal written security-policy set
- Scheduled backup/restore exercises
- SOC 2 Type I → SOC 2 Type II
Scholar's Security & Privacy Overview is self-attested by Strategic Care Group LLC. Scholar does not currently hold a SOC 2 Type I or Type II report, and no third-party penetration test has been performed. See the full disclosure for current assurance status.