Security — Logics Academy Foundation

Security & Data Protection

Last reviewed: October 2026

Logics Academy takes the security and privacy of educator data seriously. Foundation is built with security-by-design principles and undergoes regular security assessments. This page summarizes our security posture for school districts and institutional partners evaluating the platform.

🇨🇦 Data Residency

All primary data is stored in Canada (AWS ca-central-1 region).

This includes the database (PostgreSQL), user authentication, and all uploaded files. Our infrastructure provider (Supabase) operates a dedicated Canadian data centre for our platform data.

Authentication & Access Control

Control	Status
Email/password authentication	✅
Google OAuth single sign-on	✅
Microsoft Azure AD single sign-on	✅
Password hashing (bcrypt)	✅
Role-based access control (RBAC)	✅
Row-level database security policies	✅
Secure password reset flow	✅

Encryption

Layer	Protection
In Transit	TLS/HTTPS enforced on all connections; HSTS with 2-year max-age
At Rest	AES-256 encryption on all database storage and file storage (AWS infrastructure)
Sensitive Fields	Additional AES-256-GCM application-level encryption for tax and financial data (SIN, business numbers). Encryption keys stored separately from the database.
Passwords	Cryptographically hashed with bcrypt; never stored in readable form

Application Security

HTTP Security Header	Status
Content-Security-Policy	✅ Configured
X-Frame-Options	✅ DENY
X-Content-Type-Options	✅ nosniff
Referrer-Policy	✅ strict-origin-when-cross-origin
Permissions-Policy	✅ Camera, microphone, geolocation disabled
Strict-Transport-Security	✅ max-age=63072000

Data Handling

No client-side tracking: We do not use Google Analytics, advertising pixels, or third-party tracking scripts.
Essential cookies only: Only authentication and session management cookies are used.
No data sales: We never sell personal information to third parties.
User deletion: Complete account deletion cascades across all platform tables and storage. Deletion requests processed within 30 days.
Data retention: Defined retention periods for all data categories. Automated daily purge jobs enforce retention limits. Tax records retained 7 years per CRA requirements.

Service Providers

Provider	Purpose	Data Location
Supabase	Database, auth, file storage	🇨🇦 Canada
Vercel	Application hosting	Global (no PII stored)
Google	OAuth sign-in (optional)	🇺🇸 US
Microsoft	Azure AD sign-in (optional)	🇺🇸 US
HubSpot	CRM lookup (read-only)	🇺🇸 US

Incident Response & Compliance

Incident Response Plan: Documented procedures for detection, containment, investigation, recovery, and notification.
Breach notification: Compliant with PIPEDA breach notification requirements. Affected individuals and the Office of the Privacy Commissioner of Canada are notified when there is a real risk of significant harm.
Privacy policy: Comprehensive, bilingual privacy policy available at foundation.logicsacademy.com/privacy
Regular assessments: Security audits conducted periodically with documented findings and remediation.

Platform & Infrastructure

Technology: Next.js, TypeScript, PostgreSQL
Hosting: Vercel (application), Supabase (database & storage)
Source control: Private GitHub repository with branch protection
No student data: Foundation is designed for educators and education professionals. We do not knowingly collect data from students or children under 13.

Questions?

For security inquiries, data protection questions, or to request our full security assessment, please contact:

Logics Academy

Security & Privacy Inquiries

info@logicsacademy.com