The short versionYour data is encrypted in transit and at rest, hosted on Google Cloud, and never used to train AI models. We welcome responsible disclosure and pay bug bounties.
Infrastructure
Schedgility runs on Google Cloud Platform in US-Central and EU-West regions. We use Firebase Authentication for identity, Firestore for application data, and Cloud Storage for syllabus uploads.
Encryption
All traffic is encrypted in transit with TLS 1.3. All data is encrypted at rest with AES-256. Database backups are encrypted with separately-managed keys.
Access control
Production access is limited to the engineering team and gated behind hardware security keys. All production access is logged. We use principle-of-least-privilege for service accounts.
AI providers & data handling
When you use chat or parsing, your content is sent to Anthropic or Google through their enterprise APIs. Per our agreements, your data is not retained beyond the request, not used for training, and not visible to provider staff.
Account security
Passwords are hashed with bcrypt (cost factor 12). Optional two-factor auth is available via authenticator apps. Sessions expire after 30 days of inactivity.
Backups & retention
We back up application data nightly with a 30-day rolling window. When you delete your account, your data is removed from production within 24 hours and from backups within 30 days.
Incident response
If we detect a security incident affecting your data, we will notify affected users within 72 hours per applicable regulations and post a public summary at status.schedgility.com.
Responsible disclosure
We pay bug bounties for valid vulnerability reports. Email security@schedgility.com with a writeup; we acknowledge within 24 hours. Please don't access data that isn't yours, run automated scans against production, or publicly disclose issues before we've patched them.
- Critical (RCE, auth bypass, data leak): $500 – $2,500
- High (privilege escalation, sensitive data access): $200 – $750
- Medium (XSS, CSRF on sensitive flows): $50 – $300
- Low / Informational: thank-you + swag
Compliance
Schedgility is SOC 2 Type I (in progress, expected Q4 2026). We comply with GDPR for EU/UK users, CCPA for California users, and FERPA where applicable to university partnerships.
Questions? Email security@schedgility.com and a person will reply.