Trust & Security

Last updated: September 9, 2026 · Draft — under legal review

How Manifest protects classrooms: what we run, who processes schools data, how long anything is kept, and what happens if something goes wrong. The companion policy for what we collect is the Student Privacy Notice.

Security measures

Data minimization first: students have no email, password, or contact information with us — the strongest protection is data we never hold. Roster imports keep names only and discard every other column.
Encryption: all traffic is encrypted in transit (TLS); data is encrypted at rest by our database and storage providers; stored third-party credentials are application-encrypted with AES-256-GCM.
Isolation: the schools product runs on its own domain serving only schools pages; schools sessions are inert on the consumer product and vice versa; database row-level security restricts schools tables to backend service access only.
Login protection: student login is rate-limited per network address and per classroom, PINs are unique 6-digit codes per classroom, and sessions expire server-side. Class PINs are classroom credentials by design — printable by teachers, protecting name-only accounts — with guessing bounded by the per-classroom limits.
AI privacy pipeline: student prompts pass through a PII-scrubbing proxy and run on US-hosted, zero-data-retention model infrastructure. Student content is never used to train models.

Breach notification

If we determine that a security incident has resulted in unauthorized access to or disclosure of student data, we will notify the affected schools without unreasonable delay and no later than 72 hours after confirming the incident, describing what happened, what data was involved, and what we are doing about it — and we will cooperate with the school’s own notification obligations to parents and authorities. Our internal incident response process covers detection, containment, notification, and post-incident review.

Data retention

Student data lives for the life of the classroom and no longer. Teachers can export everything for a class, and permanently delete a class — immediately and irreversibly — from their dashboard.

Data	Retention
Roster (display name, avatar, PIN)	Life of the classroom; erased on permanent class deletion.
Student work (prompts, conversations, apps, files)	Life of the classroom; erased on permanent class deletion, exportable first.
Student login sessions	Expire after 12 hours, or up to 180 days when a student stays signed in on their own device — teachers can require daily sign-in for shared devices. (Teachers: 30 days.)
Failed-login IP records	Deleted after 30 days (kept only to stop PIN guessing).

Subprocessors

These providers process schools data on our behalf, each bound to use it only to provide their service to us. No third-party ad trackers or third-party analytics run where students work.

Provider	Purpose
Vercel	Application hosting and AI request routing (Vercel AI Gateway).
Supabase	Primary database (rosters, classrooms, conversations).
AI inference provider	AI model inference for student builds — US-hosted, zero data retention, no training on inputs.
Amazon Web Services (S3)	File storage for files uploaded to student apps.
Neon	Per-app databases backing the apps students build.
GitHub	Source code hosting for the apps students build.
Resend	Email delivery to teachers only — students have no email.

Data Privacy Agreement for districts

We offer a signable Data Privacy Agreement modeled on the SDPC National DPA, covering FERPA school-official designation, data ownership, subprocessors, breach notification, and disposition on termination. Request it at privacy@madewithmanifest.com.