Security

Last updated: September 17, 2026

This page explains how I protect the data described in my Privacy Policy. I would rather tell you exactly what I do than borrow impressive-sounding certifications, so everything below is specific and true.

Where things run

Guayaba Education runs entirely on Cloudflare's infrastructure: the applications and the database. Cloudflare maintains its own independently audited certifications for that infrastructure, listed on the Cloudflare Trust Hub.

Encryption

All traffic between your browser and the app is encrypted with TLS. Data is encrypted at rest by the storage systems it lives in.

Access

I run Guayaba Education myself. Access to production systems is limited to me, protected by strong unique credentials and two-factor authentication. There are no employees or contractors with access to your data.

Passwords

Account passwords are stored hashed. I cannot see your password, and I will never ask for it.

Student sign-in. Students join only through a class code from their teacher, with a password (stored hashed) or their school Google account. Sessions use secure, HttpOnly cookies, and a sign-out-of-all-devices control exists.

AI processing

Essays are evaluated through a commercial AI API under an agreement that prohibits using the data to train AI models. What is sent is what the evaluation requires: the essay text and the optional first name label. In the portal, AI helps teachers draft activities from public sources; student answers to practice and assessment questions are graded on my servers, not sent to an AI provider.

Data minimization

The best protection is not holding data in the first place. The essay grader stores no essay text at rest, only the resulting scores and feedback. The student portal collects the minimum a class needs to function: name, school email, enrollments, and schoolwork. I never collect student birthdays, phone numbers, photos, or demographics, there are no third-party trackers or analytics on student pages, and application logs contain metadata and counts, not student work.

If something goes wrong

I maintain a written incident response plan. If a security incident affects your data, I will notify you by email without unreasonable delay, and I honor the 72-hour notification commitments in signed district agreements.

Reporting

Found a vulnerability or something that worries you? Write to hello@guayabaeducation.com and I will respond quickly.