Security and trust

Where data lives

The application, its database and uploaded files run on Amazon Web Services in the United States (us-west-1, Northern California). Cloudflare sits in front of the site for HTTPS and protection against attacks. The full list of providers that touch personal data, and what each receives, is on our sub-processor list.

Encryption

• In transit: every page and API call is served over HTTPS, and browsers are told to refuse plain HTTP (HSTS).
• At rest: the server disk is an encrypted AWS volume, and file storage and database backups are encrypted in Amazon S3 with public access blocked.
• Secrets: passwords are stored as salted bcrypt hashes and sign-in codes as hashes. Two-step verification keys are encrypted by the application as well as the disk.

Signing in

• Learners sign in with a one-time code emailed to them, or a password. Codes expire after 10 minutes and work once.
• Any account can turn on two-step verification with an authenticator app. It is required for staff administrator accounts.
• Students who arrive from your LMS through LTI 1.3 sign in through your LMS, so your campus single sign-on and its policies apply.
• Repeated failed sign-ins lock the account temporarily, and every sign-in, sign-out and failed attempt is recorded in an audit log.

Students, schools and FERPA

When a school uses Questiva Consultants for a course, we act as a school official with a legitimate educational interest under FERPA. We use student records only to provide the service, we do not sell them or use them for advertising, and we do not use them to train AI models. Teachers see the students in their own classes and nothing else. Details are in the privacy policy, and we sign data protection agreements with institutions.

Payments

Card payments are taken in Authorize.net’s hosted payment form. Card numbers never reach our servers, which keeps us in the smallest PCI DSS scope (SAQ A).

Monitoring and logging

• Application errors are reported to our error-monitoring service as they happen.
• Every change to our cloud infrastructure is logged by AWS CloudTrail, and AWS GuardDuty watches the account for threats.
• Staff access to production is limited to named people, and the cloud console requires two-step verification.

Backups and recovery

The database is backed up daily to encrypted storage and kept for 90 days, and the server disk is snapshotted daily and kept for 14 days. We have restored a production backup end to end and checked it matched, so we know the backups work.

How long we keep things

Scheduled jobs delete data when its window ends. People can download or delete their own account from their account settings; a school can ask us to do it for its students.

Deleted data can remain in a backup until that backup expires.

How we build it

• A build cannot ship while a shipped library has a known high or critical security advisory.
• Automated tests cover sign-in, access control, LTI launch validation and data deletion, and run before every release.
• We run full internal security reviews and fix what they find.

If something goes wrong

We follow a written incident response plan. If we confirm that a school’s data has been exposed, we tell the school without undue delay, and within 72 hours, with what happened, what data was involved and what we are doing about it.

What we don’t claim

We are a small company, so we would rather you hear this from us: we do not have a SOC 2 report or ISO 27001 certification. We have not yet completed an independent penetration test or a third-party accessibility audit (VPAT). Our accessibility statement says where that work stands. If your review needs one of these, tell us and we will say honestly where it is.

Contact

Found a security problem? See how to report a vulnerability. Anything else: [email protected].