Security

The application runs on Vercel and the database is Neon Postgres, both in US regions. Traffic is served over HTTPS, and both providers encrypt data at rest. Uploaded files (for example a score report a student submits) are stored in Vercel Blob with private access.

A student sees their own work. A teacher sees the students in their own classes, and a school admin sees every class in their school. Nobody at a school sees another school. A parent or guardian sees a progress summary only if the student invites them, and the student can stop sharing at any time.

Other students see a student's results in two places. The public leaderboard shows recent test scores under a leaderboard name, never a real name; it is on by default, and a student can turn it off in Settings. Members of a study group a student joins see that student's name, and their test scores unless the student has turned the leaderboard off.

Inside UnlimitedTests, administrative access is limited to the founders. Our "view as user" support tool, which shows the product as a given user sees it, is read-only: while it is on, it blocks the actions that change a user's data.

We keep an audit log. It records changes to a school's roster, staff, classes, assignments, and settings; each time a teacher or school admin opens an individual student's page; every student spreadsheet export and pilot-report download; each time a founder starts or stops "view as user" or opens a student's tutor conversations in our admin tools; and each time a parent is invited, accepts, or has sharing stopped. Each entry records when it happened and, for actions taken while signed in, which account took it.

Views of class-level pages — the class list and the on-screen school report — are not logged individually. Neither is a parent viewing a shared summary, or a founder opening a student's record in our internal admin pages (other than their tutor conversations). Pages a founder sees while using "view as user" on a student account — including that student's tutor conversations — are not logged one by one. When a founder uses "view as user" on a school staff account, a student page opened during that session is logged under the staff account; the start and stop entries show when the tool was in use.

Students sign in with Google or with an email address and password. Passwords are stored hashed with bcrypt, never in readable form. Email-and-password accounts must verify their address before they can sign in, can turn on two-factor authentication, and have their sign-in attempts rate limited per address and per network. Google sign-in relies on the security of the student's Google account, such as Google 2-Step Verification; our own two-factor setting does not apply to it.

Sage, our AI tutor, uses Anthropic's Claude through Anthropic's API. When a student chats with Sage, we send Anthropic the student's message and the earlier messages in that conversation, the page they are on, and the question on screen (with its answer choices, correct answer, and explanation). We also send a short profile: first name; target test, score, and test date; learning-style preference; up to 500 characters of study notes the student wrote for the tutor; practice activity over the last 30 days and recent accuracy; weakest and strongest topics; the topics of recent missed questions and how they were missed; summaries of earlier tutor sessions, if any exist; and what the student asked Sage under practice questions in the last 7 days. While it answers, Sage can also look up the student's practice statistics and score estimate. The explanation chat beside an SAT or ACT question sends that question (with its answer choices, correct answer, and explanation), the student's answer, and whether it was right, along with short summaries of recent Sage chats and what the student asked under other recent questions on that topic; a hint on a practice question sends the question and the hints already given. Fix this mistake, after a wrong answer in practice, sends the question (with its answer choices, correct answer, and explanation), the choice the student picked, and what they write about how they approached it; the new question it serves afterwards is never sent. The short AI note on a Checkpoint result sends the score estimate and its range, the change since the last Checkpoint, the student's goal, and their weakest topics. An ACT practice essay submitted for scoring is sent with the prompt it answers, so an AI model can score it. An uploaded score report is sent to Anthropic so an AI model can read the scores for us to check. We never send a student's email address or test accommodations. Anthropic processes this only to serve the request and does not train on it.

A school can turn the AI tutor off for all of its students, from its school page. The check runs on our server for every AI feature a student can reach: Sage, AI essay scoring, AI reading of uploaded score reports, and the short AI note on a Checkpoint result.

Retention periods, and the main service providers that process data for us, are in the privacy policy. A school admin can download a summary spreadsheet of their current students at any time, and we provide a complete record for any of the school's students on request. We delete student records on the school's written request. Any student can download their data or delete their own account from their settings.

The production database is copied every night by a job that runs on GitHub Actions. Each backup is a full copy of the database, stored in Cloudflare R2 and deleted after 30 days. A weekly job restores the latest backup into a temporary database to prove it can be restored. We do not encrypt the backup file ourselves; it relies on Cloudflare's encryption of stored data.

Errors are reported to Sentry with an opaque user id, never an email address. Before a report is sent, we remove email addresses, cookies, IP-address headers, and request bodies, and we do not attach console logs. Scheduled jobs record their runs so a silent failure is visible.

If we confirm a security breach that affects a school's student data, we will notify that school's named contact within 72 hours of confirming it, saying what happened, which data was involved, and what we are doing about it. We will also notify affected users as the law requires.

Signing out ends the session, but the browser can keep things we store on the device. That includes display settings, a random ID used for usage events, saved copies of pages the student opened, and — if a session was interrupted — an in-progress practice session (its questions and the student's answers) or test answers that had not finished saving. The app stops using those last two after 6 hours, but they stay in the browser until they are replaced or the browser's site data is cleared. On a shared computer, students should sign out of UnlimitedTests and of their Google account when they finish, and use their own browser profile where they can.

We are a two-person company, and it would be misleading to imply otherwise. We do not have a SOC 2 report, and we have not yet commissioned an independent penetration test. We have not signed a student data privacy agreement with a district consortium, though we are glad to sign one — the National Data Privacy Agreement is the usual form, and we will work through it with any school that asks.

We do not have a VPAT, and we have not done systematic testing with screen readers; the accessibility statement lists what does not work yet.

No human expert reviews every question. Our questions and explanations are written with AI to the published digital SAT specification and checked by separate AI review passes; we fix or withdraw a question when a check or a student's report shows it is wrong, and a person reviews every question a student reports.

Write to support@unlimitedtests.com. If you believe you have found a vulnerability, tell us there and we will reply.

A school review usually wants the accessibility statement alongside this page — it is written the same way, and says what is not accessible yet.