You are trusting us with data about parents and students. This page lists what protects it today, and what is not in place yet.
Every table that holds customer data carries an org_id. Supabase row-level security policies limit every signed-in query to your organization's rows, so one program cannot read another program's data.
Supabase encrypts data at rest, and all connections use TLS. Supabase Auth hashes passwords with bcrypt. Server keys stay on the server and are never sent to the browser.
Every query from your account is limited to your program's rows. Background jobs run on the server and handle each program separately.
We store only what you and the families who write to you enter. We do not track browsing, add analytics scripts, or sell data. The third-party services that touch your data are Vercel (hosting), Supabase (storage), Google Gemini (drafting replies from the inquiry and your approved answers), Resend (email) and Stripe (billing, paid plans only).
Hosted on Vercel (serverless functions) and Supabase (managed Postgres). Both providers publish SOC 2 Type II reports. Backups follow the Supabase platform policy for this project.
Owner and staff roles. Only owners can invite team members or change billing. Supabase Auth handles sign-in. To remove someone's access, remove them in Settings, under Team.
Every AI-written reply is checked by a deterministic program before it is sent. It checks for prices, offers, links and claims that are not in your approved answers; replies that fail are held back. Offers and claims are matched against word lists, so the scorecard shows what is and is not caught. See the published guardrail scorecard.
Inquia is in early beta and run by one developer. It does not have its own SOC 2 report or a formal FERPA review yet. If your school or program needs one of these before signing up, email us and we will tell you exactly where things stand.
If you find a security issue, email pushkalku@gmail.com. We aim to respond within 2 business days and will not pursue legal action against good-faith security researchers.