Authentication
Supabase Auth handles all authentication. Magic link and Google OAuth are the primary paths. Optional password auth is gated behind Site-URL validation because password reuse is the largest single vector for account takeover across the internet. Sessions use chunked base64 cookies that survive the ~4KB per-cookie limit — a workaround for browsers that’s well-documented in our code.
Vendors and subprocessors
See our subprocessors page for the full list of vendors that process user data on our behalf. The short list: Anthropic (tutor + grader inference), Stripe (billing), Supabase (auth + DB + storage), Vercel (compute + edge), Upstash (Redis rate limiting), PostHog (analytics), Resend (email). Every vendor is under a written DPA.
Anthropic API terms
Anthropic does not train on data submitted through its API — that is their published default, not something we negotiated. We do not hold a zero-retention agreement and have no enterprise contract with them, so prompts and completions may be retained for a limited period for trust and safety under their standard commercial terms. An earlier version of this page said the opposite; it was wrong, and on a security page that is the kind of thing worth correcting loudly. See child safety for the specific under-18 workflow.
Incident response
Any security incident affecting user data is disclosed to affected users within 72 hours, along with the remediation taken. Report suspected issues to security@brainback.chat. PGP available on request.
Compliance
Brainback is not SOC 2 or HIPAA certified, and the SOC 2 work has not begun — it is on the roadmap, not under way. No third party has penetration-tested us either, so there is no pen-test summary to send; what we can send is our own threat model, the application self-audit behind it, and the remediation list it produced. If your institution requires attestation for procurement, say so and we will tell you honestly where we are rather than where we would like to be.
Rate limiting
Per-user rate limiting via Upstash Redis with a token-bucket algorithm. Different limits per surface: tutor turns (50/hr), explain-back grading (30/hr), recall reviews (unlimited under free tier caps). Bursts allowed; sustained abuse rejected. Anonymous users share a stricter global bucket.
Data retention
Account data lives for the life of the account plus 30 days after deletion (for accidental-deletion recovery). Session data (chat transcripts) can be deleted individually or in bulk from Settings → Privacy. See data handling for the retention specifics.