Security & trust
Private by policy. Isolated by architecture.
Student work deserves trust that's engineered, not promised. This page is written to be forwarded to your IT director.
Never sold
Student data is never sold, never used for advertising, and never used for anything beyond the educational service. It is never shared with data brokers either.
Never advertised against
There are no ads on KodeStep and no third-party analytics or tracking inside the app. School licenses are how it's paid for.
Never used to train models
Student work is not used to train AI models. The optional AI review is off today; when a school enables it, comments are removed and no name, email or account ID is sent.
Our privacy policy and standard data agreement, published before launch, will state all three commitments in writing.
Architecture
Graded code never touches student records
Running untrusted code is the riskiest thing a coding platform does. KodeStep runs graded submissions on a separate server with no path back to the data, and practice code in an isolated, opaque-origin browser sandbox on its own subdomain.
Application
kodestep.com
The editor, dashboards and APIs. Holds sessions, enforces roles, and sends every graded submission to the execution server.
Execution server
Separate, firewalled server
Runs each submission in a fresh sandbox with networking disabled. No database access and no platform credentials. Students never reach it directly; only the application does.
Database
Row-level security per school
Every school's rows are fenced off by database-enforced policies, on top of the application's own checks.
Blast-radius thinking: even a worst-case sandbox escape lands on a machine with no student accounts, no grades and no platform credentials.
Practices
Defense in depth, as a habit
Encryption in transit and at rest
HTTPS everywhere with HSTS, backups encrypted before they leave our pipeline, and hosting providers that encrypt stored data.
School isolation in the database
PostgreSQL row-level security separates every school's data below the application, in addition to the application's own filters.
Breached-password screening
New and reset passwords are checked against known breaches using k-anonymity: only a short hash prefix ever leaves our servers.
Rate limits and abuse controls
Per-student, per-school and platform-wide limits on code execution, plus throttles on sign-in and account creation.
Audit logging
Sensitive actions, including every View as Student session, go to an append-only audit log kept for 3 years. School admins can read their own school's log.
Tested recovery
Encrypted daily, weekly and monthly database backups, a tested restore path, and versioned migrations with rollback scripts.
Compliance
The acronyms, answered
What procurement will ask, and where we stand today, stated plainly.
FERPA
Designed with FERPA in mind: school-directed use, minimal data collection, and deletion on a documented schedule. We don't claim a certification.
COPPA
For students under 13, KodeStep follows the school-consent model: the school consents as the parent's agent, under its signed data agreement.
No trackers
No ads, no third-party analytics and no tracking pixels inside the app.
Data agreements
Pilot schools sign a Data Privacy Agreement before any student joins. Our standard agreement and privacy policy will be published before launch.
WCAG 2.1 AA target
Semantic HTML, keyboard-first navigation, screen-reader support, and automated accessibility checks in the test suite.
Minimal by design
KodeStep follows a documented bare-minimum data collection policy: it stores what running a class needs, and nothing for marketing or profiling.
Data lifecycle
Deletion happens on a calendar, not a promise
Every kind of data has a set retention window. The platform's own scheduled jobs enforce most of them; backups and export files expire through storage lifecycle rules.
| Data | Retention |
|---|---|
| Practice-run records | 30 days |
| Auto-saved drafts | 7 days after last activity |
| Archived classes | 2 years (default) |
| Audit logs | 3 years |
| Deletion-compliance records | 5 years |
| Stored export files (school and student exports) | 7 days after they're generated |
| After cancellation: read-only export window | 30 days (set per school) |
| After the export window: removed from the live database | 30 days later (set per school) |
| Encrypted database backups | Daily copies kept 30 days, weekly 90 days, monthly 1 year. Outside the deletion cascade: they expire on their own. |
| Point-in-time recovery | Within our database provider's recovery window. Outside the deletion cascade: it expires on its own. |
Students can export their own completed work while they can still sign in. A student who loses access to a school-issued email account can't export on their own, so it's worth downloading before leaving. A departing school gets a read-only export window before anything is deleted.
Subprocessors
Everyone who touches the data, listed
Full transparency beats a vague “trusted partners” clause. This is our current inventory.
| Service | Purpose | Data involved |
|---|---|---|
| Clerk | Sign-in and accounts | Emails, sign-in profiles, password hashes |
| Stripe | School billing | School IDs and invoice line items. No card data passes through KodeStep. |
| DigitalOcean | Hosts the code-execution server | Submitted code |
| Neon | PostgreSQL database | All platform data |
| Vercel | Application hosting | Requests and function logs |
| Upstash | Rate limiting and caching | Counters and IDs, no personal data |
| Cloudflare R2 | File storage, backups and exports | Challenge assets, encrypted backups, exports |
| Cloudmersive | Malware scanning | Uploaded files, scanning only |
| Resend | Recipient emails and notification content | |
| Anthropic | AI review summaries (not active) | Nothing is sent until zero data retention is confirmed in writing |
| Axiom | Structured logging | Scrubbed logs, IDs only |
| Sentry | Error monitoring | Scrubbed error context, IDs only |
| Have I Been Pwned | Breached-password checks | A 5-character password-hash prefix |
| GitHub (Actions) | Runs encrypted database backups | Database backups, encrypted before they leave the runner |
Responsible disclosure
Found a vulnerability? We want to hear about it. Email us with the steps to reproduce it.
kent@kodestep.comProcurement has questions. We have a demo.
Bring your IT director. The security walkthrough is our favorite part.
Pilot schools pay nothing · data agreement first