Security and student data
This page is a practical security overview for parents, students and school procurement reviewers. It is not a certification claim. It explains the controls we operate today and the review notes we can provide before a school trial.
StudyVector account access is handled through the configured authentication provider for email, magic-link and approved OAuth sign-in paths. We keep service-role credentials server-side and do not expose database admin keys to browser code.
Public traffic is served over HTTPS. Production data is stored with managed database controls and provider-level encryption at rest. Payment card details are handled by Stripe rather than stored by StudyVector.
The public site and app runtime are hosted on Cloudflare. Core product data uses Supabase, payments use Stripe, and email or analytics providers are limited to the purposes described in our privacy notices.
Internal access is kept to the minimum needed to support the product, debug issues, answer support requests and maintain safeguarding obligations. School procurement reviews can request the current subprocessor and retention notes before a trial.
Signup is designed for students aged 13+ and includes student privacy information. Product choices such as dyslexia mode, calmer reading settings and reduced-overload layouts are treated as accessibility and safeguarding work, not cosmetic extras.
If we identify a security incident, we triage scope, contain the issue, rotate affected credentials where needed, preserve evidence, and notify affected users, schools or regulators where the law requires it.
For a school review pack, contact schools@studyvector.co.uk with your role, school type, required documents and expected student age range. For provider, trust or awarding-body review conversations, use the organisation review route so evidence, claim boundaries and review owners stay explicit.