Security overview

Architecture

Kuraplan is a web application. The browser talks to application and API servers on Vercel, which talk to a Postgres database and file storage on Supabase, which runs on Amazon Web Services. AI requests go from our API to model providers through Vercel AI Gateway. Nothing runs on school infrastructure and there is no mobile app or browser extension.

The database is not reachable from the internet. Servers connect through a connection pooler with SSL required. The browser only ever holds a short-lived user token scoped by row-level security; privileged keys stay on the server.

Encryption

• In transit: TLS 1.2 or higher on every hop, including between our servers and every provider. Plain HTTP is redirected.
• At rest: AES-256 for the database, file storage and backups, managed by Supabase on AWS.
• Certificates are issued by Let's Encrypt and renewed automatically.

Tenancy and access

Every table that holds personal data is protected by Postgres row-level security. Policies default to deny and allow only the signed-in user, and where relevant their school, to read or change rows. A user in one school cannot discover or access users or content from another school.

Each person signs in with their own email and password or their Google account. Passwords are salted and hashed with bcrypt by Supabase Auth. Reset links are random, single-use and time-limited.

Administrative access to production is limited to the founder, protected by multi-factor authentication, and logged. Kuraplan never needs remote access to school devices or networks and never asks a school for credentials.

Perimeter

Vercel Firewall provides DDoS protection, managed rulesets and rate limiting in front of the app and API.

Development practice

Production and development are separate projects. Development uses synthetic data. Every change goes through a branch, a pull request, automated checks and a preview deployment before it reaches production. Dependencies are pinned and monitored for known vulnerabilities. Serverless hosting means there is no operating system for us to patch; the platform providers patch theirs.

Monitoring and incident response

Authentication events, privileged actions and errors are logged by Supabase, Vercel and Sentry. Errors and unusual activity alert the founder in real time. Security, privacy and online-safety incidents are handled under a written incident response plan and recorded in an incident register. Affected schools are told as soon as possible and within 72 hours of a confirmed breach.

Backups

The database is backed up daily. Restores are tested after major infrastructure changes and at least once a year. We are extending retention to at least 90 days.

Payments

Payments run through Stripe Checkout. Card numbers are entered into Stripe directly and never touch Kuraplan systems. Stripe is PCI-DSS Level 1 certified.

People

Kuraplan is operated by its founder, who is the named security lead and privacy officer. Work devices use full-disk encryption, screen lock, remote wipe and automatic updates. Any contractor with production access is subject to the same controls, a confidentiality agreement and a background check.

Reporting a vulnerability

Email security@kuraplan.com. We acknowledge within two business days and will not take action against good-faith research that respects user privacy and avoids service disruption.