Security controls

Infrastructure

• Encryption in transit

  In place

  TLS 1.2 or higher on every connection, HTTP Strict Transport Security enabled, no plaintext endpoints.

• Encryption at rest

  In progress

  Database volumes and object storage are encrypted at rest according to the hosting providers' documentation. Our own configuration review is pending.

• Managed hosting with SOC 2 Type II providers

  In place

  Render (compute and PostgreSQL), Clerk (identity), Cloudflare (storage). Provider reports available to districts under NDA.

• United States data residency

  In place

  Production database and backups live in the United States (Ohio).

• Automated daily backups

  In place

  Managed daily database backups are confirmed on. The restore procedure is documented; the first restore test has not yet been run.

• Network isolation

  In progress

  Database connections require TLS. Restricting connections to the application and a named administrator is pending a configuration review.

Access control

• Multi-factor authentication for staff

  In progress

  Enforced in the application since November 13, 2026: every staff member has an enrolled authenticator, and the admin console and teacher portal refuse staff accounts without one. Two-factor on the remaining production consoles (hosting, DNS, source control, payments, email) is being confirmed.

• Least privilege

  In place

  Administrator capability is granted by an explicit allowlist. Teachers see only their own organization's students. Students see only their own records.

• Role-based access in the product

  In place

  Student, teacher, organization owner and administrator roles are enforced server-side on every request.

• No shared accounts

  In place

  Every person with production access has a named account. Service credentials are stored in the hosting provider's secret store, never in source code.

• Access reviews

  Planned

  Production access will be reviewed quarterly and on any personnel change. The first review has not yet been recorded.

• Audit log of staff access to student records

  Planned

  Server-side log of administrator views and exports of student data.

Application security

• Content Security Policy

  In place

  Per-request nonce-based CSP with strict-dynamic blocks injected scripts; frames from other sites are refused.

• Authentication by a dedicated identity provider

  In place

  We never store passwords. Sign-in, password hashing, session management and MFA are handled by Clerk.

• Rate limiting

  In place

  Sign-up, checkout, connector and support endpoints are rate limited to slow abuse.

• Webhook signature verification

  In place

  Every inbound webhook (identity, payments) is verified against a signing secret and de-duplicated.

• Secure development lifecycle

  In place

  Changes ship from version control through automated builds and type checks; dependencies are updated on a regular cadence.

• Third-party penetration test

  Planned

  Independent application penetration test with remediation report.

Data protection

• Data minimization

  In place

  We collect what the study plan needs and nothing else: no demographics, no parent contacts, no special-program indicators.

• No advertising, no profiling, no sale

  In place

  School accounts never see upsells or pricing, no advertising tags load for them, and we never sell or rent personal information.

• No student data to AI assistants

  In place

  Our Claude and ChatGPT connector is disabled for school accounts. No student record is sent to any AI model.

• Deletion and return of data

  In place

  Per-student export and erasure, and per-district erasure with written certification, within the timelines in our agreements.

• Error monitoring without personal data

  In place

  Error reports strip personal identifiers before they leave our servers.

Organizational

• Named security coordinator

  In progress

  A security coordinator owns this program and is reachable at security@classictestprep.com. The named designation is being formalized in our district agreements.

• Written policies

  In progress

  Information security, access control, incident response, data retention and destruction, vendor management, secure development, and security awareness policies are drafted and under owner review. Available to districts on request once approved.

• Incident response and breach notification

  In progress

  Plan drafted; first tabletop exercise not yet run. Affected districts are notified without unreasonable delay after confirmation and in every case within the period their agreement and Florida law require.

• Security awareness training

  Planned

  Everyone with access to student data will complete privacy and security training at onboarding and annually. No completions are recorded yet.

• Risk assessment

  In progress

  A 2026 risk assessment is drafted and awaiting owner review. Results available to districts on request once approved.

• Business continuity and disaster recovery

  In progress

  Plan drafted. The annual restore test from backups has not yet been performed.

• SOC 2 report

  Planned

  Classic Test Prep does not yet hold its own SOC 2 report. Our hosting, identity and payment providers do.

Architecture in one paragraph

A single Next.js application runs on Render in the United States and talks over TLS to a managed PostgreSQL database on the same platform. Sign-in is delegated to Clerk, so we never see or store a password. Lesson videos are static files on Cloudflare storage. Transactional email goes out through Resend. Payments, for individual customers only, go through Stripe Checkout; card numbers never touch our servers. Error reports go to Sentry with personal data stripped. There is no data warehouse, no third-party analytics on school accounts, and no AI model in the student data path.