Security

Reporting a vulnerability

If you believe you've found a security issue in Rostrum, please email [email protected]. We'll acknowledge within two business days, triage within five, and work with you on a coordinated disclosure. Good-faith researchers are covered by the safe-harbor language in our SECURITY.md.

How we handle incidents

We maintain an internal incident-response runbook that defines how we detect, contain, investigate, and communicate security incidents. It covers severity classification, the clock for our notification commitment (see the Privacy Policy), templates for user and district notifications, and a post-mortem process. We run tabletop drills quarterly.

Data handling basics

• All traffic is served over HTTPS.
• Your data lives in Supabase (Postgres + Auth + Storage) with row-level security policies scoping access to your organization.
• Payment data is handled by Stripe. We do not store card numbers.
• Email is sent via Resend. We only email you about your account, billing, and anything you've opted into.
• Daily automated checks verify that storage buckets remain private and that critical credentials are in place.

For school districts

Rostrum is used by directors to manage rosters and program data, which often includes student information. We treat student data as our most sensitive category. If you represent a district and need an executed Data Processing Agreement or more detail on our security program, email [email protected].

Related

See our Privacy Policy for details on what we collect, how long we keep it, and our breach-notification commitment.