EssayGrader Trust Center
How we protect student work, teacher accounts, and institutional data — the controls we run, the documents we can share, and answers to the questions schools ask most.
Need something that isn’t here?
security@essaygrader.ai
Compliance
Frameworks we align to and documents we can share. Items under NDA are available on request through your account contact or security@essaygrader.ai.
NIST SP 800-53 Rev. 5
Our primary security and privacy controls baseline. Monitored continuously and reported by Aikido Security.
FERPA
We act as a school official under the direct control of the institution. All student work is treated as an educational record.
COPPA
No student accounts and no direct collection from children. Teachers control what is uploaded.
State privacy laws
CCPA, SOPPA, and comparable state statutes. Student data is never sold and never used for targeted advertising.
HECVAT 4.1.5
Full Higher Education Community Vendor Assessment Toolkit response covering organization, product, infrastructure, AI, and privacy.
SOC 2 Type 1
Audit program underway with internal audits and automated evidence collection already running. Our hosting provider holds SOC 2 Type II.
GDPR
We serve primarily US institutions and store data in the US. Standard Contractual Clauses are available, and EEA data subject rights are honored.
WCAG 2.1 Level AA
Accessibility Conformance Report completed May 2026. Known gaps are tracked with a published remediation roadmap.
NIST AI RMF 1.0
Our AI risk model follows the Map, Measure, Manage, and Govern functions. All staff complete responsible AI training.
Penetration test
Third-party assessment with no critical or high severity findings. Medium and low findings are tracked to closure.
HIPAA
EssayGrader does not process protected health information. Do not upload PHI to the platform.
PCI DSS
Card data never touches our systems. Payments are handled entirely by Stripe.
Infrastructure security
Continuously monitored controls across our cloud, network, and application stack. Findings are produced by Aikido Security in real time and mapped to NIST SP 800-53 controls.
AES-256 across databases, persistent volumes, and object storage.
TLS 1.2/1.3 for all client, service-to-service, and third-party traffic.
Unencrypted HTTP is rejected and redirected to HTTPS.
Legacy ciphers and protocol versions are disabled.
Cryptographic modules used for transit and secret storage are FIPS-validated.
Crypto dependencies are monitored for CVEs and kept current.
Secure, HttpOnly, and SameSite attributes enforced on session cookies.
Cloudflare WAF covering the OWASP Top 10, DDoS mitigation, and bot filtering.
DigitalOcean managed firewalls at the perimeter plus Cloudflare filtering at the edge.
Databases and storage sit inside a private VPC with RFC 1918 addresses and no public routing.
Cloudflare inspects and blocks known attack patterns before traffic reaches the cluster.
Aikido Firewall blocks SQL injection, command injection, and path traversal in real time.
No plaintext ingress paths to application infrastructure.
DNS responses are signed and origin-verified.
Rate limiting and alerting on repeated failed authentication attempts.
Controls prevent our infrastructure being used to attack other systems.
Two application roles — Teacher and School Administrator — each scoped to their own data.
TOTP-enforced for the cloud control panel and all internal systems.
Production and raw institutional data are reachable only by the CTO and CEO.
Continuous identification of over-privileged users, roles, and service accounts.
Alerts fire on changes to roles, users, and policies.
Escalation paths in roles and users are detected and remediated.
Secrets are injected at runtime from AWS Secrets Manager and verified by code scanning.
SSH key pairs and scoped API tokens only; access from unknown networks is limited.
Authentication, session, and application events stream to central logging in real time.
Login, logout, failed attempts, MFA events, and source IP are captured.
Each grading action records user, timestamp, action, and institution. Retained 1 year.
Control-plane actions including firewall rule changes are recorded.
Access patterns are analyzed for unusual activity and exfiltration attempts.
Aikido Security and Cloudflare monitor around the clock, with critical alerts paging on-call staff immediately.
Retained 60 days with point-in-time recovery inside the window.
Backups replicate from NYC3 to SFO3 daily over encrypted transport.
Multiple replicas per deployment on DigitalOcean Kubernetes behind a managed load balancer.
Guards against accidental destruction of production infrastructure.
Terraform and Helm definitions allow a full environment rebuild.
Spend and capacity thresholds are alerted on.
Aikido scans code, dependencies, and container images for CVEs and license risk.
Functional, regression, and security scenarios run on every code change.
Client and server-side validation; errors reveal no stack traces or internals.
Guards against SQL injection and cross-site scripting.
Dependencies are tracked for end-of-life status; base images are rebuilt on a schedule.
Changes are verified in staging before reaching production.
The application does not request device location.
Known CVEs, misconfigurations, and exposed attack surface are monitored from outside the perimeter.
Code, dependencies, and images are scanned and remediated before deployment.
Regular scanning for injection, XSS, CSRF, and related classes.
Completed February 2026. All findings medium or low severity; none critical or high.
Institutions may scan or test our systems at a mutually agreed time and scope.
Critical and high findings are prioritized ahead of scheduled work.
Organizational security
How the company itself is structured and governed — who we are, who works here, and how we manage the vendors that sit behind our service.
Privately held Delaware C-Corp, incorporated 2024, founder-led with no parent or subsidiary entities.
No physical office or company-operated data center; all infrastructure is cloud-hosted.
Security is led by the CTO, with the CEO serving as Data Protection Officer.
Nine-person software and systems team under the CTO, split across defined functional roles.
No material unplanned disruptions or outages in that period.
Cyber Liability, Errors & Omissions, and Media Liability coverage.
Background and/or reference checks are completed prior to joining.
Confidentiality/NDA and policy acknowledgements are required before work begins.
Required for all employees and contractors, covering FERPA, GDPR, and internal handling rules.
Responsible AI training aligned to the NIST AI Risk Management Framework (AI RMF 1.0).
Access is provisioned by role and revoked on role change or departure.
Full-disk encryption, MFA via SSO, VPN for sensitive systems, and current OS patching.
DigitalOcean, AWS, OpenAI and similar, each with independent third-party attestations.
Including OpenAI, with breach liability addressed contractually.
Repeated annually against our internal security baseline.
Applied to any vendor that collects, processes, or can access personal data.
Handled at the infrastructure layer by DigitalOcean under their SOC 2 Type II program.
Documented, owned, and tested annually.
Documented recovery procedures, responsibilities, and escalation paths; tested annually.
Owned by the CTO and DPO, supported by automated alerting and external counsel.
Critical alerts page on-call personnel at any hour.
In the event of closure or discontinuation, institutions keep full data access throughout.
Internal security procedures
The day-to-day practices behind the controls: how changes ship, how patches land, how access is reviewed, and what happens when something goes wrong.
Agile lifecycle with security considerations at design, build, review, and release.
Security requirements are defined before implementation begins.
OWASP guidance is embedded throughout development.
Any change touching personal data triggers a privacy impact review before release.
Aikido and Dependabot track third-party libraries continuously.
Severity-based prioritization across application, container, and infrastructure layers.
Prioritized ahead of planned work.
Cloudflare rules and runtime blocking cover the gap until a fix ships.
Unsupported libraries are flagged for replacement.
All privileged accounts are reviewed on a documented interval.
Enforced through the RBAC model between security administration, system administration, and user functions.
Conducted annually as part of the SOC 2 audit program.
Generation, storage, and rotation handled via AWS Secrets Manager and provider-managed KMS.
Led by the DPO, including the CTO, Chief Data Scientist, and external legal counsel.
Initial privacy impact assessment is performed on every incident.
Or sooner where the law or the institution’s agreement requires it.
A feature flag or full deployment rollback disables AI processing, and reverses it once resolved.
No reportable breach and no privacy policy or privacy law violation in the past 36 months.
Legal
Public agreements and the contracts institutions most often ask us to sign. We routinely sign district and university data privacy agreements.
Standard DPA for institutions, including GDPR Standard Contractual Clauses.
By request
Current third parties that process institutional data, and what each one does.
By request
We sign district and state SDPA templates, including NDPA-style agreements.
By request
Which models we use, what is sent to them, and what they may not do with it.
By request
Accessibility Conformance Report against WCAG 2.0 and 2.1 Level A and AA.
By request
Written notice within 72 hours of confirming a breach, or sooner where required.
By request
Cyber Liability, Errors & Omissions, and Media Liability coverage.
By request
FAQ for teachers
Practical answers about what happens to your students’ work and how much control you keep over grading.
Is my students' work safe here?
Short version: yes. Everything is encrypted in transit and at rest, sits on US infrastructure, and is scoped to your account — other teachers can't see your classes, and no one at your school can outside your own administrators.
The longer version is the rest of this page. If your IT department wants the detail, the schools FAQ below has it.
Does EssayGrader sell student data?
No. We operate a zero-secondary-use policy: student data is never sold, never used for targeted advertising, and never used to build behavioral or demographic profiles.
It is used for one thing — running the grading, AI-detection, and writing-progress features you asked for.
Is EssayGrader FERPA compliant?
Yes. We act as a school official under the direct control of your institution, and we treat every student submission as an educational record under FERPA — whether or not it contains identifying information.
We sign district and university data privacy agreements as a matter of course.
Is my students' writing used to train AI models?
No. Grading runs through the OpenAI API under an enterprise agreement with Zero Data Retention enabled. Submitted content is held in transient memory only for the length of the request, is never stored by OpenAI, and is contractually prohibited from being used for training.
We also do not train or fine-tune any models of our own on your content.
Does the AI decide my students' grades?
No. EssayGrader is built around a teacher-in-the-loop model. AI-generated grades and feedback are presented to you as a draft. Nothing is recorded or shared with a student until you review it, and you can accept, edit, or discard any part of it.
There is no fully automated decision-making anywhere in the product.
Should I include student names in what I upload?
We ask you not to. Names and other identifying details aren't needed for grading.
If identifying information does end up in a submission, an automated sanitization layer redacts personally identifiable information before anything is sent to an AI provider.
Who at EssayGrader can read my students' essays?
Support staff cannot access essays, rubrics, instructions, or grades. Access to production systems and raw institutional data is limited to the CTO and CEO, both behind enforced MFA and least-privilege controls.
Can other teachers at my school see my classes?
No. Teachers can only see their own data. A School Administrator role exists that can view teacher activity within its own school and manage school settings, but administrators have no elevated access to anything outside their institution.
Do my students need accounts?
No. EssayGrader does not create or store student accounts. Teachers and administrators are the only account holders, and they control what is uploaded.
Can I upload handwritten work?
Yes. The platform accepts typed documents as well as images of handwritten student work, which are processed for grading like any other submission.
How long is my data kept, and can I delete it?
Data is retained only as long as it's needed for the purposes in our Privacy Policy or your institution's agreement. After an account or contract ends, data stays available for 60 days for export and is then permanently deleted from systems, databases, and backups.
You can request deletion at any time through your account or by writing to privacy@essaygrader.ai.
Can I get my data out?
Yes. Full or partial exports are available on request in CSV or JSON, and can be scoped by date range, user group, or data type.
Who owns what I upload and what the AI produces?
You and your institution do. That includes inputs, outputs, AI-generated feedback, and metadata. Ownership doesn't change if the company is acquired or ceases operating.
Can I turn the AI features off?
No — AI grading is the core of the product, so disabling it would leave nothing to use. What you can control is how much of its output you accept, since every grade passes through your review.
Is the platform usable with a keyboard or a screen reader?
All primary functions can be performed with keyboard-only navigation, verified in May 2026 on Chrome and Edge. Our Accessibility Conformance Report documents partial conformance to WCAG 2.1 AA along with the specific gaps we're working through.
Accessibility problems can be reported to support and are triaged like any other issue.
Will I be logged out automatically?
Yes. Sessions time out after 60 minutes of inactivity, with a maximum session length of 12 hours.
What happens if the service goes down while I'm grading?
The platform has run at 99.9% uptime over the past 12 months with no material unplanned outages. If something does break, a 24×7 on-call rotation is paged automatically, and service notices are posted in-app.
FAQ for schools
For IT, security, procurement, and privacy reviewers. A completed HECVAT 4.1.5 is available and answers most of this in more depth.
How is our institution's data protected?
AES-256 at rest, TLS 1.2/1.3 in transit, private VPC with no publicly routable data stores, WAF and DDoS protection at the edge, and per-institution logical isolation at the application layer.
Internal access follows least privilege: only the CTO and CEO can reach production systems or raw institutional data, both behind enforced MFA, with access reviewed on a documented interval. There has been no reportable personal data breach in the past three years.
What is your FERPA position?
We operate as a school official under the direct control and instruction of the institution, and treat every submission as an educational record regardless of whether it contains identifying information.
We sign K-12 and higher education DPAs, including state and NDPA-style student data privacy agreements, and will accommodate institution-specific privacy policies.
What else is our data used for?
Nothing. A zero-secondary-use policy applies: no sale of data, no targeted advertising, no behavioral or demographic profiling, and no enrichment against outside datasets.
Processing is limited to the purposes set out in your DPA, and every subprocessor is contractually held to the same restriction.
Do you support SSO?
Yes. Enterprise SSO is configured per institution over SAML 2.0 (SP- and IdP-initiated) or OIDC, through our authentication provider Clerk. Azure AD, Google Workspace, Okta, and any standards-compliant IdP are supported.
Custom attribute mapping and just-in-time provisioning are available; SCIM-based provisioning is supported for automated account lifecycle management. We do not currently participate in InCommon or eduGAIN.
What if we don't use SSO?
Local authentication is available with email and password, plus passwordless options (email OTP, magic links). MFA can be made mandatory for all users via TOTP apps, SMS, or email codes. Password strength follows NIST guidance and is evaluated with zxcvbn; passwords are never stored in plaintext and never touch our application code.
Where does our data live?
In the United States. Production runs on DigitalOcean Kubernetes in NYC3, with encrypted backups replicated daily to SFO3. Institutional data does not enter or leave the US at any point during collection, processing, storage, or archiving.
DigitalOcean operates in other regions if a specific residency requirement needs discussing.
Is the environment single-tenant?
No — it's multi-tenant SaaS. Institutional data is logically separated at the application layer through organization-scoped data models, so records are only reachable by authenticated users belonging to that institution.
Who are your subprocessors?
The main ones are DigitalOcean (hosting), OpenAI (grading), GPTZero (AI detection), Clerk (authentication), AWS Secrets Manager (secrets), Cloudflare (edge security), and Stripe (payments). Each operates under a DPA that restricts data use to delivering the contracted service.
A current list is available on request.
Do you sign our DPA or student data privacy agreement?
Yes. We routinely sign DPAs with both K-12 districts and higher education institutions, and will sign GDPR Standard Contractual Clauses where relevant. Institution-specific privacy policies are accommodated.
Do you have SOC 2?
Not yet. SOC 2 Type 1 is in progress, and internal audits plus automated evidence collection are already running under that program. Our hosting provider holds SOC 2 Type II, ISO 27001, and PCI-DSS; their report is available directly from them.
In the meantime, our NIST SP 800-53 alignment is continuously monitored and the report is available here.
Can we run our own vulnerability scan or penetration test?
Yes, at a mutually agreed time, date, and scope. Write to security@essaygrader.ai to arrange it. Our own scan results are available under NDA, and a third-party assessment completed in February 2026 found no critical or high severity issues.
How quickly are we notified of a breach?
Within 72 hours of confirmation, or sooner where the law or our agreement with you requires it. The notice includes the information required under FERPA, GDPR, and applicable state law.
There has been no reportable personal data breach in the past three years.
What is your data retention and deletion process?
Institutional data stays available for 60 days after a contract ends so you can export it, then is permanently deleted from systems, databases, and backups. Written confirmation of deletion is available on request.
Verified stop-processing requests are honored promptly, including notifying OpenAI to cease processing.
How is data encrypted?
AES-256 at rest across databases, volumes, and object storage; TLS 1.2/1.3 in transit for client, internal, and third-party traffic. Cryptographic modules are FIPS 140-2/140-3 validated.
At-rest keys are managed by DigitalOcean at the platform level, which means they hold technical access under their SOC 2 Type II scope. Application secrets sit in AWS Secrets Manager.
What audit logs can we get?
Authentication events (login, logout, failed attempts, MFA, session changes, source IP), application-level user and administrator actions, and AI usage logs recording user, timestamp, action, and institution.
All security-relevant logs are retained for one year from creation, stored with access restricted to the CTO and CEO. Logs scoped to your own users are available on request within five business days; a self-service log interface is not yet available. Institution-specific logs can be deleted on request at any point, and all of an institution's logs are deleted within 60 days of contract termination.
What does the AI actually receive?
Only the essay content and grading rubric needed for the task, after an automated sanitization pass that strips personally identifiable information. No student names, identifiers, or account metadata are transmitted.
Each request is a single scoped API call — no plugins, no tool calling, no multi-step chains — with token limits per request.
Is the solution accessible?
Partially. An Accessibility Conformance Report completed in May 2026 covers WCAG 2.0 and 2.1 Level A and AA and identifies gaps including timing adjustable, bypass blocks, and page titles, each tracked on a remediation roadmap. A third-party accessibility audit is planned; the current ACR was prepared internally.
We will commit contractually to working toward WCAG 2.1 AA conformance.
What is your uptime and disaster recovery posture?
99.9% over the past 12 months. The service runs highly available within a single region with multiple replicas behind a managed load balancer. There is no live secondary region; recovery uses daily encrypted cross-region backups with 60-day retention and point-in-time recovery.
Business continuity and disaster recovery plans are documented, owned, and tested annually.
Will you notify us before changes?
Yes, for anything that could affect security posture or user experience. Note that the product is a single-version multi-tenant SaaS, so institutions cannot defer or opt out of a release. Non-critical maintenance runs roughly 1:00–4:00 AM Eastern.
How do you handle law enforcement requests?
No institutional or student data is shared without a valid warrant or subpoena. Every request is reviewed by the DPO, CTO, and external legal counsel, and nothing is released until legal validity is confirmed.
Do you carry cyber insurance?
Yes — Cyber Liability, Errors & Omissions, and Media Liability. A certificate is available on request.
Who do we contact?
Security and vendor assessments: security@essaygrader.ai. Privacy questions, data subject requests, and complaints: privacy@essaygrader.ai, acknowledged within 48 hours.
Our Data Protection Officer is Chan Yerneni, supported by external legal counsel.