Trust Center

How Silvia handles safety, privacy, security, accessibility, and data across our products, in one place. We distinguish clearly between controls that are in place today and commitments we are still working toward, and we understate rather than overclaim.

Policies

Safety and Responsible AI

Review, auto-post safeguards, prohibited high-stakes uses, and incident response.

Privacy Policy

What Skyline collects, why, who can receive it, and how long it's kept.

Terms of Service

Terms governing authorized use of Skyline by Silvia.

Accessibility Statement

WCAG 2.2 AA conformance target, current measures, and audit status.

Compliance by framework

Only Skyline is in customer use today. Skyline is built to follow these frameworks, but we have not completed independent third-party audits or certifications and do not yet offer signed data processing agreements. Districts with specific compliance requirements can reach us at privacy@silviaai.dev.

Framework	Scope	Skyline	Supra
FERPA	US K-12 student education records	Aligned by design; not yet reviewed	N/A
COPPA	Under-13 children's data	Aligned; school-authorized	N/A
WCAG 2.2 AA	Accessibility	Target, not yet audited	N/A
SOC 2	Security controls (independent audit)	On the roadmap	N/A
GDPR	EU / UK personal data		N/A
CCPA / CPRA	California consumer privacy		N/A

Security and architecture

Skyline runs on infrastructure from SOC 2-audited providers (including Supabase, Vercel, and Stripe), with defense-in-depth across the stack. The controls below are in place today.

US hostingThe web app, database, and grading engine all run on US-region infrastructure (Vercel, a Supabase Postgres 17 instance in us-west-1, and Railway).
EncryptionAll traffic is served over TLS, and data is encrypted at rest by our infrastructure providers.
Database-level isolationPostgreSQL row-level security is enabled on every table, so each teacher's data is scoped to their own account and enforced by the database itself - not by application code alone.
AuthenticationSign-in is handled by Supabase Auth (email and Google) with rate-limited login to resist brute-force and credential-stuffing attempts.
Signed access linksStudent and portal links are HMAC-SHA256 signed and verified in constant time, so they cannot be forged, guessed, or altered.
Service isolationThe grading engine only accepts requests carrying a shared secret verified in constant time, and privileged database credentials are never exposed to the browser.
Billing integrityPayment webhooks are cryptographically signature-verified, and all billing and credit operations run server-side under a privileged role that end-user sessions cannot invoke.
Rate limitingAuthentication, API, and AI endpoints are rate-limited per client to contain abuse and automated attacks.
Error monitoringApplication errors are captured through Sentry with user identifiers minimized.

Data handling

What we process, where it lives, and how long we keep it. See the Privacy Policy for the full detail.

What we processTeacher account details; the classes, assignments, and rosters a teacher creates or imports; and student submissions (files, images, or typed work) together with the grades and feedback generated from them.
AI processingTo grade, the assignment work itself is sent to Anthropic (scoring and feedback) and, for math, to Mathpix (OCR). We do not attach separate student records - names, emails, or grade history - and the grading engine references each student by an opaque internal ID. Work is processed as submitted, and Anthropic does not use data sent through its API to train its models.
Data residencyAll primary data is stored in the United States.
RetentionSubmissions, grades, and account data are kept until the teacher deletes them or closes the account; deletion removes the underlying records.

Subprocessors

Services we use that hold or process user data on Skyline's behalf.

Infrastructure and service providers

SupabaseAuthentication and primary database (Postgres, row-level security)
VercelApplication hosting for the web app and marketing sites
RailwayHosting for the grading engine (OCR, scoring, and review pipeline)
AnthropicAI processing of selected assignment content for scoring and feedback
MathpixOCR transcription of handwritten or scanned work, when OCR is enabled
StripeBilling, invoicing, and payment processing
SentryError tracking and diagnostics, when configured

School-authorized integrations

Connected only when a teacher or district opts in, limited to the data and actions they authorize.

Google ClassroomRosters, coursework, and submissions, only as authorized by the connecting teacher
AeriesDistrict SIS gradebook sync, pilot/partner-gated

Contract terms, regions, and provider availability can change. Schools may request the current subprocessor list and applicable contractual commitments at privacy@silviaai.dev.

Report or ask

Security vulnerability: security@silviaai.dev
Privacy question or data request: privacy@silviaai.dev
Everything else: team.silviaai@gmail.com