Security at Notegrade

Plain facts for district IT and privacy staff about how Notegrade is built and run. The privacy page lists every piece of student data we keep and why.

Where data lives

Notegrade runs in its own Amazon Web Services account in the United States. Essays, rosters and scores are stored in an Amazon Aurora PostgreSQL database in the US East (N. Virginia) region. When Notegrade drafts scores, the essay is processed by Amazon Bedrock in AWS regions in the United States and is not stored there.

Encryption

In transit: every page and every API call uses HTTPS, and browsers are told to use HTTPS only. Internal queues accept encrypted connections only.
At rest: the database, its backups and file storage are encrypted.

Students sign in with their school Google account. Notegrade checks the verified email against the teacher’s roster and accepts school accounts only, not personal ones. Notegrade never sees the password.
Each student gets a private token that works only for their own essay and expires a day after they submit.
Teachers sign in with an email and password through Amazon Cognito. Cognito supports two-factor sign-in with an authenticator app, and we are adding the setup screen to the teacher app.
A teacher can only open their own classes, rosters and essays. Every request that names a class, essay or student checks who owns it.

Audit trail and logs

Every change a teacher makes, every export, and every time a teacher opens an essay, a student’s page or a gradebook is recorded with the account, the time and the request id.
Every response carries a request id. Error messages show it, so a problem can be traced without anyone sending us student data.
Application logs record ids, not essay text, names or emails. They are kept for 90 days.
The only third-party script on any page is Google sign-in on the student join page. There are no analytics, ad or tracking scripts.

Deletion and backups

A teacher can delete one student, or a whole class, from inside Notegrade. It is permanent and happens right away.
A school or district can ask us to delete its data, and a teacher can ask us to delete their account. We delete it within 60 days of the request and confirm in writing.
Database backups are kept for 14 days, so deleted data is gone from backups within 14 days after that.

If something goes wrong

If we learn that student data was accessed without permission, we will tell the affected schools within 72 hours of confirming it, say what happened and what data was involved, and help schools meet their own notice duties to families.

Subprocessors

Amazon Web Services: hosting, database, file storage, teacher sign-in, and access to the drafting model through Amazon Bedrock.
Anthropic: maker of the Claude model that drafts scores, reached through Amazon Bedrock. Per AWS, prompts are not shared with the model provider.
Google: student sign-in with school Google accounts.

Any company that runs plagiarism or AI-use checks for Notegrade will be listed here before those checks are turned on.

What we do not do

We do not collect birth dates, home addresses, location, photos, or anything from the camera or microphone.
We do not record other tabs, other websites, or anything after a student submits.
We do not show ads, and we do not sell student data.
Student essays are never used to train AI models.

Report a security issue

Email matt@notegrade.com. When you report a problem, please include the request id from any error you saw, and do not include student data.