Security
What we do and don’t claim about data safety while the product is still being built.
Where data lives
Phloem runs on Vercel with a Supabase Postgres database. Row-level security policies are enforced for every teacher and department row, so a signed-in teacher only ever reads what belongs to their own department.
Passwords
Teacher passwords are hashed by Supabase Auth and never seen by our application code. We’ve enabled leaked-password protection so common breached passwords can’t be reused.
Emails on the waitlist
The only piece of personal data we hold in pre-launch is the email address you submit to the waitlist. It is stored so we can send one launch announcement and nothing else. It is not shared with any third party.
Reporting a vulnerability
If you find a security issue, please write to [email protected] with the words “security” in the subject. Please give us a reasonable window to fix things before disclosing publicly.
What we don’t claim
Phloem has not been penetration-tested by a third party and does not hold any formal certification. If you are a school procurement team and need one, tell us — that’s a specific piece of the roadmap and having a real name to plan around helps.