Security at WorksheetGen

We build for schools and districts. That means security and compliance are not afterthoughts -- they are built into every layer of the product from day one. Here is exactly how we protect your data.

• All data encrypted in transit using TLS 1.3
• Data encrypted at rest using AES-256
• HardDrive connections use SSL certificates
• API keys and secrets stored in environment variables, never in code

• We never use student work, teacher inputs, or worksheet content to train AI models
• Generated worksheets are stored only in your account and can be deleted at any time
• No third-party data sharing for advertising or analytics profiling
• AI inference uses commercial API endpoints with enterprise data protection agreements

• Hosted on Vercel with SOC 2 Type II certified infrastructure
• PostgreSQL database with automated backups and point-in-time recovery
• Redis rate limiting prevents abuse and DDoS attacks
• Content moderation blocks PII, profanity, and inappropriate content before generation

• Authentication via Clerk with SSO support (Google Workspace, Microsoft 365)
• Role-based access: teacher, school admin, district admin
• Webhook idempotency prevents duplicate processing
• Rate limiting: 3 generations per minute, 10 per hour per user

• FERPA compliant: no education records shared without consent
• COPPA compliant: parental consent flow for students under 13
• GDPR compliant: data processing agreement available on request
• SOC 2 Type I audit in progress
• Accessibility: WCAG 2.1 AA compliance