Current controls
- Public site and APIs are deployed on Vercel with HTTPS.
- Payment card details are handled by Stripe Checkout, not collected directly by Math Foundation.
- The demo and lesson pages on this marketing site store learner progress locally in the browser.
- The application at app.math.foundation stores learner records in a managed PostgreSQL database (Neon) used only by Math Foundation, with family, class, school and district tenant boundaries enforced on the server.
- Sign-in is by emailed magic link, Google OAuth, or a school-configured OIDC identity provider. Automated provisioning tokens and learning-management-system API keys are stored as SHA-256 hashes, never in plaintext.
- School rollout forms should capture adult buyer and procurement details, not student personal information.
- Security headers include strict transport security, frame protection, content-type protection, and a restrictive permissions policy.
Current limitations
These are stated plainly because schools are entitled to know them before a pilot:
- No independent penetration test has been completed against the production application.
- No formal threat model covering cross-tenant access, compromised teacher accounts, guardian–child relationships, exports, or model-provider data flows has been published.
- No independent WCAG 2.2 AA audit has been completed — see the accessibility statement.
- No privacy impact assessment has been completed for the production data model.
- Backup restore and incident-response procedures have not yet been exercised in a documented drill.
Math Foundation should not be represented to a school as having passed any of these reviews until it has. This page will be updated with dates and scope as each is completed.
Contact
Report security concerns privately to hello@math.foundation.