Security at WorksheetGen

This page describes controls visible in the current product and their limits. It is not a certification, legal opinion, penetration-test report, or promise that a district will approve a particular use.

• Application traffic is served over HTTPS
• Hosted database and infrastructure providers manage encryption at rest
• Database connections use encrypted transport when supported by the configured provider
• API keys and secrets stored in environment variables, never in code

• Worksheet Generator does not train its own models on customer prompts or worksheets
• Generated worksheets are stored with your account; the Terms and Privacy Policy describe quality review and possible template use
• Prompts are sent to the AI providers identified in the privacy policy to produce requested content
• Users are instructed not to submit student personally identifiable information

• Application hosting and managed PostgreSQL are supplied by third-party infrastructure providers
• Rate limiting and permanent Free-plan counters reduce automated abuse
• Input and output moderation block selected high-confidence sensitive-content patterns
• Provider certifications do not constitute a Worksheet Generator certification

• Authenticated application routes enforce account ownership checks
• Administrative routes require a configured allowlist and a database-backed user match
• Webhook idempotency prevents duplicate processing
• Generation limits are plan-aware and permanent Free-plan usage is claimed transactionally

• The product is designed for teacher-directed use and does not require student accounts
• No independent FERPA, COPPA, GDPR, SOC 2, or WCAG certification is claimed
• Schools must evaluate the product and its subprocessors for their intended use
• Account export, deletion, and email-unsubscribe controls are available