Security
Effective 2026-07-30
Architecture
- HTTPS everywhere with HSTS; TLS 1.2+ only.
- Authentication via Clerk (SOC 2 Type II); JWTs verified server-side against rotating JWKS.
- The canonical Clerk application requires passwords of at least 12 characters and screens compromised passwords. Authenticator-app MFA and backup codes are available but are not currently mandatory for every account. SAML and enterprise SSO are not currently enabled.
- Postgres on managed infrastructure with backups, encryption at rest, and per-environment isolation.
- OAuth tokens encrypted with AES-256-GCM using a per-environment encryption key.
Cookies and tracking
Authentication and security cookies are listed in the public Cookie Policy. Optional product analytics are off by default, require affirmative consent, and can be withdrawn in Settings. Analytics identity and session state are memory-only; a local opt-out marker may remain after withdrawal. StudySite uses no advertising trackers.
Application controls
- Strict input validation — every API write rejects unknown fields (no silent persistence).
- Webhook idempotency — duplicate deliveries from Clerk/Stripe/GitHub are no-ops at the unique-constraint level.
- Audit log records sensitive operations (role changes, exports, deletion requests) with actor + IP.
- Sandbox isolation — student code runs in E2B containers, never in our application process.
Reporting
Found a vulnerability? Email admin@studysite.aiwith “Security” in the subject. We'll acknowledge within 2 business days and work with you on a coordinated disclosure timeline.