Real cryptography, not just promises.

Zero-knowledge encryption is available as an opt-in setting and is off by default. You can turn it on at any time from Settings → Privacy. When a family enables it, chat content and conversation titles are encrypted on the user's device before they reach Studea's servers. The key is derived from a passphrase that only the family holds. Studea operates the database but cannot read the content of an encrypted family's messages.

• Per-family Data Encryption Key (DEK), 256-bit, generated in the browser and never transmitted in plaintext.
• Passphrase-derived Key Encryption Key (KEK) via PBKDF2-SHA-256 at 600,000 iterations, making brute-force attacks impractical.
• Symmetric encryption with AES-256-GCM, including authentication tags that detect any tampering with stored ciphertext.
• One-time recovery codes generated at setup; codes are themselves wrapped keys, not stored as plain credentials.
• Students receive the family key via a parent invite using a random bootstrap key in the URL fragment — browsers never transmit fragments to the server.

All traffic to Studea is served over TLS 1.2 or higher. Data at rest is stored in a managed Postgres database with disk-level encryption. Sensitive credentials — including Canvas access tokens and optional task-app integrations — are additionally encrypted at the application layer with AES-256-GCM before being written to the database.

Studea runs on managed cloud infrastructure in U.S. data centers. We use a deliberately small set of sub-processors:

• Supabase — Database and authentication. SOC 2 Type II.
• Anthropic — Claude API for AI responses. Enterprise terms prohibit training on API-submitted data and require enterprise-grade data handling.
• Canvas (Instructure) — Studea reads assignments, grades, and announcements directly from the school's Canvas instance using the credentials the user provides. The school's existing agreement with Instructure controls that data.
• Resend — Transactional and weekly-digest email delivery. Receives recipient addresses and the message content.
• Vercel — Application hosting plus aggregate, privacy-preserving usage analytics and performance monitoring. Not used for behavioral advertising, and not sold.
• Twilio — SMS delivery, used only when a user opts into SMS alerts and provides a phone number.

• Primary authentication is email and password or a magic sign-in link via Supabase Auth, using standard salted password hashing. Sign in with Google is available as an optional alternative where enabled.
• Row-Level Security policies in the database enforce parent-student and family-membership boundaries at the SQL level, not in application code alone.
• Internal Studea engineering access requires SSO and is logged and audited. Customer data access is restricted to named personnel with a legitimate operational need.
• Background jobs authenticate with a service token held in a managed secret store.

• FERPA

  Studea is designed to operate as a school official under the FERPA School Official Exception when adopted by a school. We will execute a Data Processing Addendum on request.

• COPPA

  Children under 13 may only use Studea with verifiable parental consent, or through a school's authorization for educational use.

• State student-privacy laws

  Studea's data-handling practices are designed to align with state laws including California's SOPIPA, New York Ed Law § 2-d, and similar statutes.

• SOC 2

  Studea is preparing for SOC 2 Type II attestation. Current status is available on request to security@studea.app.

We welcome reports from security researchers and customers. Send vulnerabilities to security@studea.app. We acknowledge reports within two business days and aim to triage critical issues within five.

In the event of a confirmed breach affecting personal information, we will notify affected users and the relevant schools without undue delay and in accordance with applicable state and federal breach-notification laws.