HeuriSight treats student data security as our highest priority. We implement enterprise-grade security measures that meet or exceed industry standards for educational technology platforms.
Hosting: HeuriSight is hosted on AWS US-East (Virginia), providing enterprise-grade infrastructure with data sovereignty in the United States.
Data Encryption
Encryption in Transit
TLS 1.3: All data transmitted between users and our servers is encrypted using the latest TLS protocol
HTTPS Only: We enforce HTTPS across all connections with HTTP Strict Transport Security (HSTS)
Certificate Pinning: Protects against man-in-the-middle attacks
Encryption at Rest
AES-256 Encryption: All student data stored in databases and file storage is encrypted using AES-256
Encrypted Backups: All backup copies are encrypted with separate keys
Key Management: Encryption keys are managed through AWS Key Management Service (KMS)
Infrastructure Security
Cloud Infrastructure
HeuriSight is hosted on enterprise-grade cloud infrastructure:
AWS (Amazon Web Services): SOC 2 Type II compliant cloud platform
Multi-Region Redundancy: Data backed up across multiple geographic regions
DDoS Protection: AWS Shield protects against distributed denial of service attacks
Web Application Firewall: Protects against common web exploits
Database Security
Neo4j AuraDB: Managed graph database with enterprise security
Pinecone: SOC 2 compliant vector database
Automated Backups: Daily automated backups with 30-day retention
Point-in-Time Recovery: Can restore data to any point in the last 30 days
Application Security
Authentication & Authorization
Auth0: Enterprise identity management platform
Multi-Factor Authentication (MFA): Available for all administrative users
Single Sign-On (SSO): Integration with institutional identity providers (SAML, OAuth)
Role-Based Access Control (RBAC): Granular permissions by user role
Session Management: Automatic logout after inactivity, secure session tokens
Application Code Security
Secure Development: Following OWASP Top 10 security guidelines
Code Reviews: All code changes reviewed for security vulnerabilities
Dependency Scanning: Automated scanning for known vulnerabilities in third-party libraries
Input Validation: All user inputs validated and sanitized
Socratic Probing: The AI probes reasoning in real time, asks follow-ups, and adapts to student responses — reducing the value of pre-generated answers
Evidence-Backed Scoring: Rubric-aligned scoring is backed by verbatim conversation quotes and traceable message IDs
Adaptive Re-anchoring: Follow-up questions test genuine understanding, not memorized responses
Practice vs Assessment Modes: Clear visual separation between practice and graded assessments
Attempt Controls: Configurable limits on summative assessment attempts
What HeuriSight cannot detect:
We believe in being transparent about the limitations of any technology-based assessment system:
Identity Verification: We do not verify identity beyond the HeuriSight login authentication. We cannot confirm who is physically using the account.
Off-Screen Assistance: We cannot detect if a student is receiving coaching from another person or using a second device/screen during an assessment.
Recommended mitigations:
Include clear integrity expectations in your course syllabus
Use assessment-only mode during graded windows to focus student attention
Faculty can review full conversation transcripts and override scores if needed
Grade appeals are supported by complete transcript records
Data Retention & Deletion
Active Data: Retained while institutional subscription is active
Post-Termination: 30-day grace period for data export
Secure Deletion: Data securely deleted within 90 days of contract end
Backup Purging: All backup copies deleted within 90 days
Verification: Certificate of deletion provided upon request
Service Availability & Support
Uptime Target: 99.5% availability
Support Response: We aim to respond to critical issues within 4 hours and general inquiries within 1-2 business days
Incident Communication: Status updates provided during any service disruption
Reporting Security Issues
If you discover a potential security vulnerability:
Questions About Our Security?
We're happy to discuss our security practices in detail, provide security documentation for your procurement process, or schedule a security review call with your IT team.