Security · for procurement and IT

Security at PD That Works

Last reviewed September 2026. Every statement on this page is current and verifiable; where something is not offered, this page says so instead of implying it. The narrow, honest exceptions to content access are listed in the Privacy Notice §4.

How data flows

The application runs on Vercel (Next.js); data lives in Supabase (Postgres) with its authentication service. Teachers write private check-ins; the AI coaching runs through Anthropic’s API; email is delivered by Resend; payments are processed by Stripe — card numbers never touch our systems. The complete list of processors, with locations and what each one sees, is on the Subprocessors page.

All traffic is encrypted in transit (TLS, with HSTS enforced across the domain). Storage encryption at rest is provided by our hosting providers, per their published platform security.

Access control — the privacy floor is in the database

The teacher-privacy boundary is enforced with row-level security on the tables themselves, not in the interface: a school leader’s account is never served a teacher’s reflection, goal text, or coaching conversation, in any privacy mode. Everything drawn from what teachers write reaches leaders only as aggregates behind a five-teacher floor; participation status follows the privacy mode the school chose and disclosed to teachers before they joined, which in named-participation mode includes each teacher’s name with whether and when they last checked in. The selected privacy mode is frozen for the length of a cycle by a database constraint. The full model is on Teacher privacy.

Sign-in uses emailed one-time codes and links — no passwords to breach. Internal operational surfaces are role-gated, and revoked administrator memberships lose access immediately.

AI provider and training posture

Coaching runs on Anthropic models over the API. As stated in our Privacy Notice, our AI provider does not use our data to train its models unless we expressly permit it — we have not and will not. Free text is scanned server-side before AI processing and high-signal identifiers (emails, phone numbers, IDs, names in student context) are replaced with placeholders; we describe that scan honestly as defense in depth, not a guarantee.

Student data

The product is for teachers’ professional practice and is not designed to hold student records. Teachers are instructed not to enter student names or identifying details, the scrubbing layer above backstops that instruction, and entering student-identifying information is prohibited by the Terms.

Retention, export, and deletion

Teachers can export their own writing from inside the product, and deletion works as described in the Privacy Notice. School data-processing terms are part of the School & District Terms; data-processing addendum requests: hello@pdthatworks.com.

What we don’t claim

• No third-party certification (SOC 2, ISO 27001) is currently held, and none is implied.
• Database backups are taken daily by our hosting provider and retained for seven days; we restored from backup in a recorded drill on 16 August 2026 (recovery in under five minutes). Uploaded files are not included in database backups. Details in the Privacy Notice §9.
• No crisis monitoring, no scanning of teacher writing beyond the identifier scrub described above.

Incident response and disclosure

Security contact: security@pdthatworks.com. Good-faith research is welcome under the commitments below, and the form goes to the same queue — you don’t need an account, and you can stay anonymous.