Security
We believe in transparency about how we protect your data. Here's exactly what we do, and what we're still working on.
How Your Data Is Stored
In Transit: All connections between your browser and our servers use HTTPS (TLS) encryption, which protects data from interception in transit.
At Rest: Your record is stored in Supabase, which publishes a SOC 2 Type II report and provides encrypted storage. On top of that, we apply application-level envelope encryption (AES-256-GCM) to your record before it is written. Each family has its own data key. By default that key is held server-side ("encrypted at rest"), so it is protected in storage but we can still technically unwrap it, and we say so. You can end that: the Own Your Keys ceremony in Settings moves the key into your family's custody (a passkey plus a one-time recovery code) and finishes with Eformogi deleting its own copy. After that ceremony, only your family can unwrap your record. Losing both the passkey and the recovery code then means the record is unrecoverable, by anyone: that is what holding the only key means.
Locally: A copy of your record is cached in your browser's IndexedDB for offline access and fast loading. For signed-in families that local copy is AES-256-GCM encrypted as well, under a device key that never leaves your browser.
Infrastructure
How Sharing Works
The record belongs to the learner and their family. Receivers (colleges, employers, agencies, scholarship programs) only ever see what the family chooses to share, and a school that issues on the record never owns it. Here is how security works at each layer:
- Consent records: Every share produces a signed, scoped, revocable consent grant, with purpose, duration, and downstream-sharing rules. Receivers see only the fields the family approved; nothing else leaves the record.
- Consent-gated sharing: When a family responds to a receiver's intake link, only the categories they explicitly approve are transmitted. No AI is involved in the sharing step: it is a direct, consent-gated data transfer with a full audit trail.
- Verification provenance: Fields extracted from documents are linked to their source, creating provenance trails receivers can verify. Any agent can fill "Algebra II, A" into a form: only the record can prove who witnessed the work.
- Document extraction: When you upload a document, it is sent to an AI vision model to extract structured data. The original document is not retained after processing.
- No training: Per our API agreements, your data is not used to train AI models.
What We're Working On
We're a small team committed to improving security over time. Recently shipped and on the roadmap:
- ✓ Signed consent artifacts: every share produces a scoped, time-bound, revocable record (shipped V18).
- ✓ Personal API Key policies: per-category auto / ask / never controls for any agent you authorize (shipped V18).
- ✓ Audit log: full record of every share and every agent read, downloadable from your account (shipped V18).
- ✓ End-to-end encryption: the Own Your Keys ceremony moves the record key into family custody (passkey plus recovery code) and Eformogi deletes its copy at cutover. Shipped September 2026, opt-in per family; the verify page states it when a family holds its own keys.
- ☐ Client-side AI matching: run AI models locally so your data never leaves your browser for matching.
- ☐ Two-factor authentication: additional account security.
- ☐ SOC 2 Type II for Eformogi itself: we run on providers that publish SOC 2 Type II reports (Supabase, Vercel), and Eformogi holds no such report of its own. Our own audit is on the roadmap. We are not promising a date for it.
Your Rights
- Data Portability: Export all your data anytime
- Right to Delete: Delete your account and all associated data
- Transparency: We'll always tell you exactly what we do with your data
Responsible Disclosure
Found a security issue? We appreciate responsible disclosure. Please contact us:
We'll acknowledge your report within 48 hours and work with you to address it.
Breach Notification
If we confirm a security incident affecting your private information, we will notify you by email and in-app notice without unreasonable delay, and in any event no later than 72 hours after confirmation. The notice will describe what was affected, what we have done in response, and what (if any) action you should take.
We will also notify regulators where required by law, including the New York Attorney General under NY General Business Law § 899-aa, and equivalent authorities in other jurisdictions where affected users reside. Eformogi maintains the safeguards required by the New York SHIELD Act for businesses that hold private information of New York residents.
Questions?
Have questions about how we handle your data? We're happy to be transparent:
For the technical posture (subprocessors, encryption, breach SLA, what we don't do), see /security/posture.