Security & Compliance

Infrastructure Security

Where Pink Cow runs

Supabase stores the database and handles sign-in. Vercel runs and serves the application. Both process data in the United States. The same providers are named on our privacy page, with a table showing which of them handle student records.
Physical data-centre security, redundancy and failover are those providers' controls, operating to their published standards rather than ours. We describe them as theirs because that is what they are.

Network Security

TLS 1.3 for every connection, with HSTS preloaded so browsers refuse plain HTTP before trying
A content security policy, and DDoS mitigation provided by our hosting platform
Rate limiting on the endpoints that accept pasted text

Data Protection

Encryption

TLS 1.3 encryption for all data in transit
AES-256 encryption at rest on our servers
AES-256 encryption of the local database on the teacher's device, with the key held in the device keychain and never leaving it
Encrypted database backups

Data Isolation

Logical data separation between schools and districts
Row-level security (RLS) in database architecture
Tenant isolation at application and database levels
No data commingling between organizations

Access Control

Authentication

Secure password requirements with complexity rules
Multi-factor authentication (MFA) available

Authorization

Role-based access control (RBAC)
Granular permissions for different user types
Every administrator action on an account is recorded
Regular access reviews and deprovisioning

Compliance & Certifications

Educational Compliance

• We ask a parent before recording anything about their child
• That rule is enforced by the database, not by the app
• It therefore holds for the website, the iPhone app, and anything else that connects
• How student information is handled

What we can show you

• Encrypted in transit with TLS 1.3, verified against this site
• Encrypted at rest on our servers, by our hosting provider
• The copy on a teacher's phone is encrypted too, and excluded from device backups
• Named service providers, all processing in the United States

Security Practices

Development Security

Secure software development lifecycle (SSDLC)
Regular security code reviews and static analysis
Dependency scanning and vulnerability management
Security training for all developers

Data Retention & Deletion

While your account exists we keep your data, so that Pink Cow works. That does not change if a subscription ends — your data stays, and you can download all of it at any time from Settings → Your data.
Delete your account yourself, from Settings → Your data. It is deleted seven days after you ask, which leaves time to change your mind — not on a timer of ours afterwards.
Deletion is not the same for everything, and the privacy page says exactly what it removes and what it keeps — including the tax records we cannot delete on request.
The record of who opened a student's file is pruned automatically after three years. That one is on a timer, and the policy reads the same constant the job uses.

Vulnerability Disclosure

We welcome security researchers to help us maintain the highest security standards. If you discover a potential vulnerability:

Report to: security@pinkcow.app

Include: Detailed description, steps to reproduce, potential impact

Response: We'll acknowledge within 24 hours and work with you to resolve

Incident Response

In the unlikely event of a security incident:

Immediate containment and investigation
Notification within 72 hours as required by law
Full transparency about the nature and scope of the incident
Remediation steps and preventive measures
Support for affected users throughout the process

Third-Party Security

We carefully vet all third-party services:

Security assessments for all vendors
Data processing agreements with strict security requirements
Limited data sharing only when necessary
Regular review of third-party security practices