Security

The application runs on Vercel and the database is Neon Postgres, both in US regions. Traffic is served over HTTPS, and both providers encrypt data at rest. Uploaded files (for example a score report a student submits) are stored in Vercel Blob with private access.

A student sees their own work. A teacher sees the students in their own classes, and a school admin sees their school. Nobody at a school sees another school.

Inside UnlimitedTests, administrative access is limited to the founders. Sensitive actions — changing a school's settings, opening a student's results, exporting or deleting records — are written to an audit log with who did them and when. The "view as user" support tool is read-only and blocks every write while it is active.

Students sign in with Google or with an email address and password. Passwords are stored hashed with bcrypt, never in readable form. Email-and-password accounts must verify their address before they can sign in, and any account can turn on two-factor authentication. Sign-in attempts are rate limited per address and per network.

Sage, our AI tutor, uses Anthropic's Claude. A question a student asks, and the question they are working on, are sent to Anthropic to generate the answer. Anthropic processes this only to serve the request and does not train on it. A school can turn the AI tutor off for all of its students, from its school page — that also stops AI essay scoring and AI reading of uploaded score reports.

Retention windows are in the privacy policy, which also lists every third-party service that processes data for us. A school administrator can download their students' records at any time, and we delete records on the school's written request. Any student can export or delete their own account from their settings.

Errors are reported to Sentry with an opaque user id, never an email address, and known sensitive fields are stripped before they leave the server. Scheduled jobs record their runs so a silent failure is visible.

We are a two-person company, and it would be misleading to imply otherwise. We do not have a SOC 2 report, and we have not yet commissioned an independent penetration test. We have not signed a student data privacy agreement with a district consortium, though we are glad to sign one — the National Data Privacy Agreement is the usual form, and we will work through it with any school that asks.

Write to support@unlimitedtests.com. If you believe you have found a vulnerability, tell us there and we will reply.

A school review usually wants the accessibility statement alongside this page — it is written the same way, and says what is not accessible yet.