Our approach
EdGauge holds public, district-level data and the figures that districts contribute about themselves. This page says how we protect it and how to tell us if you find a problem. We claim only what is in place today. No system is perfectly secure.
Reporting a vulnerability
If you believe you have found a security problem in EdGauge, write to hello@edgauge.com. Tell us what you found, the steps to reproduce it, the affected URL or component, and the impact you believe it has. Our machine-readable contact is at https://edgauge.com/.well-known/security.txt.
We will acknowledge your report within 3 business days, keep you updated while we work on it, and tell you when it is fixed. We ask that you give us reasonable time to fix the problem before you disclose it publicly. If you would like credit for the finding, we are happy to give it.
In scope: the EdGauge web application, its API and MCP endpoints, and the edgauge.com website.
Out of scope:
- denial-of-service or load testing;
- social engineering or phishing of our staff or users;
- physical attacks;
- spam;
- vulnerabilities in third-party services we use (report those to the vendor);
- reports from automated scanners without a demonstrated impact;
- missing headers or best-practice suggestions with no demonstrated exploit.
Rules of good faith:
- Use only accounts you own or have permission to use.
- Do not access, change or delete other people's data beyond the minimum needed to show the problem. If you reach someone else's data, stop and tell us.
- Do not degrade the service.
- Delete any data you obtained once you have reported the problem.
Safe harbor. If you follow this policy in good faith, we will treat your research as authorized and will not pursue or support legal action against you for it. If a third party starts action against you for research that followed this policy, we will make it known that you acted in good faith.
No bug bounty. We do not offer payment for reports.
Hosting
The EdGauge application is hosted on Amazon Web Services in the US West (Oregon) region. Your requests reach it through Amazon CloudFront. The edgauge.com website is a separate site hosted on Cloudflare; the hosting, encryption and application sections of this page describe the application.
The database (Amazon RDS for PostgreSQL) sits in private subnets with no internet route. It is not publicly accessible and accepts connections only from the application server.
The application server accepts web traffic only from CloudFront. It has no SSH: there is no SSH key and no SSH port open. Administrator shell access is through AWS Systems Manager Session Manager only. Its operating system is patched by a weekly AWS Systems Manager maintenance window.
Encryption
In transit. Traffic between your browser and CloudFront uses HTTPS with TLS 1.2 or later. Plain HTTP is redirected to HTTPS, and HTTPS responses carry an HSTS header of one year. TLS ends at CloudFront; the hop from CloudFront to our application server travels over AWS's network and is not separately encrypted. Connections from the application to the database use TLS, which RDS PostgreSQL requires.
At rest. The database storage, its automated backups, the server's disks and every file storage bucket (Amazon S3) are encrypted at rest with AWS-managed keys. Every S3 bucket blocks public access; files are downloaded through the app with short-lived links. Application secrets are kept in AWS Systems Manager Parameter Store as encrypted SecureString values, not in our code.
Passwords are stored as bcrypt hashes. Two-factor secrets and recovery codes are stored encrypted.
Accounts
You can add two-factor authentication (an authenticator app, with recovery codes) and passkeys to your account.
Sign-in attempts are rate limited to 5 per minute per email address and IP address. Two-factor code attempts are limited to 5 per minute, and passkey attempts are rate limited too.
Sessions use secure, HTTP-only cookies over HTTPS and expire after 2 hours of inactivity.
Invitation tokens are stored only as a hash. Password reset links expire after 60 minutes and invitation links after 7 days.
Tenant isolation and access control
Every signed-in request acts as an "actor": the person, their organization and what that organization is entitled to see. Scoping to the actor happens inside the service layer that every screen, export, API call and the Ask assistant go through, not in individual pages. An automated architecture test fails the build if a public service method does not take the actor first. Organization roles are viewer, contributor, reviewer and organization admin.
Small groups are suppressed. Figures for groups below a threshold (5 by default) are not shown, and the assistant obeys the same rule.
The Ask assistant never writes database queries. It calls fixed, typed tools as the signed-in person, so it can see only what that person can see.
Our admin console and job dashboard are open only to staff addresses on an explicit allow-list, with a verified email and two-factor authentication confirmed.
An audit log records sign-ins, sign-outs, membership changes, submissions, reviews, reports, invitations and about 70 other actions, with the IP address and user agent. We keep it for 24 months.
Application
Every page and API response from the application carries security headers: X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, X-Frame-Options: SAMEORIGIN, a Content-Security-Policy that restricts base-uri, object-src and frame-ancestors, a Permissions-Policy that turns off camera, microphone, geolocation and payment, and HSTS.
Our web server log redacts tokens, signatures and email addresses from the request line and referrer before it is written. Logs are kept for 30 days.
We do not collect student records, by design; see our privacy policy.
Backups
The database has automated daily backups with point-in-time recovery, kept for at least 7 days. Uploaded files and archived source documents are versioned, and deleted or overwritten versions are kept for 30 days.
Incident notification
If we learn of a security incident that affects your personal information or your organization's data, we will notify the affected organizations and people without unreasonable delay and as the law requires. We will say what happened, what information was involved, what we are doing about it and what you can do.
Questions
General security questions, for example from a district's IT or procurement team, go to hello@edgauge.com.