Security overview

This page describes the protections TutorMaestry has in place today. It is the annex to the Data processing agreement. We describe only what the software actually does.

Your own instance

Every customer runs on their own instance: their own application, database, file storage, backups and backup credentials. Nothing is shared with another customer's instance, so one customer's data cannot appear in another's. Instances are hosted by Fly.io in Paris, France.

Encryption in transit

• The service is reached only over HTTPS. Pages send HTTP Strict Transport Security, so browsers refuse an unencrypted connection.
• The sign-in cookie is marked secure (HTTPS only), cannot be read by page scripts, and is not sent with requests from other sites.
• A strict content security policy means pages load scripts, styles and fonts only from TutorMaestry itself, and no page can be framed by another site.

Encryption at rest

• The hosting provider encrypts the storage volume that holds the database and files.
• Stored logins for services you connect (such as a Google Calendar connection) are encrypted again, with a key kept in the application's environment and never in the database, so a copy of the database does not contain a usable login.
• Family portal passwords are stored only as salted PBKDF2-SHA256 hashes.

Encrypted off-site backups

• A backup is made each day the service is used: the database, uploaded files, and a count of the records it holds so a restore can be checked.
• Each backup is encrypted before it leaves the server, to a public key (X25519 key agreement with AES-256-GCM, in chunks that are each bound to their position, so a tampered or truncated backup is detected). The server cannot decrypt its own backups; the private key is held offline by TutorMaestry.
• Backups are stored with Tigris, in a bucket of their own, and kept for 10 days: the newest of each of the last 10 days. When a person's data is erased, it is gone from backups when those backups expire.

Access control

• Everything needs a sign-in except a short list of deliberately public pages (sign-in, these legal pages, and links that carry their own one-time secret, such as a payment link). An automated check walks every route in the application before each release to prove it.
• Where a business has several staff, each has their own account and role; a tutor sees only their own pupils, and managers never see money.
• The family portal is off until you switch it on, each family's login has to be approved by you, and a family sees only its own records.
• Repeated failed sign-ins are slowed and then locked out for a while.
• TutorMaestry's own access to a customer's live data is limited to support you ask for, fixing a fault, or keeping the service secure.

Logging, monitoring and records

• Logs record what happened, not who it was about: no request bodies or form values, and links that carry a secret (payment, invitation and password links) are scrubbed before anything is logged. The web server's own access log is off.
• Errors are reported to Sentry (in the EU) with personal data switched off: no request bodies, no local variables, no names or emails.
• A record of significant actions (an invoice voided, a payment deleted, a setting changed, a plan chosen, terms accepted) is kept for 12 months, with longer-lived financial entries reduced to amounts and references.
• The service watches its own health and storage, and alerts us when something fails.

AI features

• Only on plans that include AI, and only when you use an AI feature. Requests go to Anthropic, whose commercial terms do not allow it to train models on them.
• The report writer is sent a pupil's first name, curriculum objectives and levels and notes you have allowed; never surnames, contact details or learning-needs information.
• Monthly AI use is capped per plan, and the AI never acts on its own: anything it prepares is shown to you before it is saved or sent.

Development and testing

• About a hundred automated checks run before every release, including that every page needs a sign-in unless intended to be public, that a family sees only its own data, that emails go only where a person approved, and that input limits hold.
• Dependencies are pinned to exact versions.
• Real customer data is never used to develop or test TutorMaestry, and never pasted into development tools.
• We have not yet commissioned an independent penetration test. We will say so here when we have.

Incidents

If something goes wrong, we contain it, find out what happened and who is affected, and tell you without undue delay and in any case within 48 hours of becoming aware of a breach affecting your data, with what you need to decide whether to tell the ICO and the people affected. To report a security issue to us, see the Support policy.