← Back

Security & Trust

Last updated: September 3, 2026

SLP Draft is built for solo speech-language pathologists handling sensitive student information. This page describes the technical and organizational measures we use to protect that data, the subprocessors involved, and our posture toward FERPA and district data agreements. For the legal contract, see our Privacy Notice and Terms of Service.

Encryption

  • In transit: All traffic between your browser and our servers is encrypted with TLS 1.2 or higher.
  • At rest: The database and file storage are encrypted at rest using AES-256.
  • Backups: Automated daily backups are encrypted with the same standards and stored in the same region as primary data.

Per-user isolation

Every record in our database — cases, notes, test scores, drafts, uploads, templates — is tagged with the owning user's account ID. Row-level security policies enforce that you can only read or write your own data, at the storage layer. Even our own server code uses your authenticated session when reading your data; the only paths that bypass row-level security are narrowly scoped server jobs (e.g., processing a verified payment webhook) that never return data to another user.

Authentication

  • Sign-in is Google OAuth only. We never see or store your password.
  • Sessions use short-lived access tokens with refresh-token rotation.
  • Sign-up is invite-only — accounts cannot be created anonymously.
  • Account deletion and full data export are self-serve from Account settings.

AI processing

When you click Generate or Draft, only the case text needed for that section is sent to a large-language model (Google Gemini or OpenAI GPT, via the Lovable AI Gateway). Your full case file, other students' data, and any uploaded source documents not relevant to that section are not transmitted.

Per our provider agreements, prompts and outputs are not used to train models. Inputs may be retained briefly by the provider for abuse monitoring (typically ≤30 days) and then deleted.

Test scores are never AI-generated. Standard scores, percentiles, and confidence intervals come only from what you enter. A score-fabrication check blocks the AI from inventing numbers in narrative drafts, and a contamination check prevents content from a prior case from leaking into a new draft.

Subprocessors

We rely on a small set of vetted vendors to operate the Service:

  • Supabase — database, authentication, file storage (US).
  • Cloudflare — application hosting, edge runtime, CDN.
  • Google (Gemini) and OpenAI (GPT) — AI inference, via the Lovable AI Gateway. No training on customer data.
  • Stripe — payment processing, billing, and PCI-compliant checkout. Card details never touch our servers.
  • Transactional email provider — account, billing, and security notifications.

We notify customers of material changes to this list. A current list is available on request at hello@slpdraft.com.

Data residency

Primary data storage and backups are hosted in the United States. AI inference is performed by US-based providers. If you access the Service from outside the US, your data will be transferred to and processed in the US.

Access controls

  • Production credentials are stored in a secrets manager — not in source code.
  • Administrative access to production is limited to SLP Draft personnel and protected with multi-factor authentication.
  • Our service accounts follow least-privilege: keys that don't need to bypass row-level security don't get to.
  • All administrative actions on the production database are logged.

Breach notification

If we confirm a security incident affecting your data, we will notify you by email without undue delay, and in any event within 72 hours of confirming the incident. The notification will describe what happened, what data was affected, what we've done to contain it, and what (if anything) you should do.

FERPA posture

FERPA (the Family Educational Rights and Privacy Act) applies to educational agencies — schools and districts — not directly to private software vendors. When a district contracts with a vendor to handle student records, the vendor typically becomes a school official under FERPA's exception, governed by a Data Privacy Agreement (DPA) between the district and the vendor.

SLP Draft is designed for use by individual clinicians, not contracted by districts. You — the clinician — are responsible for following your district's policies about which tools may store student-identifying information.

To make compliant use practical, the app is built around student initials and de-identified data by default. The drafting workflow does not require full names, addresses, or dates of birth beyond what you choose to enter. If your district requires a signed DPA before you may use the Service with identifiable student records, you can find our Data Privacy Agreement template here — we will countersign upon request.

HIPAA posture

SLP Draft is not a HIPAA-covered service and we do not currently offer a Business Associate Agreement (BAA). The Service is intended for school-based speech-language pathologists documenting educational evaluations, which fall under FERPA, not HIPAA, when performed as part of a student's IEP or 504 process.

Do not enter Protected Health Information (PHI) into SLP Draft if you provide services in a setting governed by HIPAA (private practice, clinic, hospital, telehealth under HIPAA, etc.) without first de-identifying the data. Use initials and minimum-necessary details — never full names, dates of birth, Social Security numbers, insurance identifiers, or medical record numbers from a HIPAA-covered source.

If your work requires a signed BAA, contact us before using the Service so we can confirm whether a HIPAA-eligible plan is available for your situation.

Data ownership & portability

  • You own your data. Your account is tied to your Google identity, not to any employer. Switching jobs does not change ownership.
  • Export anytime. Account settings include a one-click JSON export of every case, note, test, draft, and template.
  • Delete anytime. Account deletion is self-serve and permanently removes your data from active systems; backups containing your data are overwritten on the normal rotation cycle and are not used for any other purpose in the meantime.

Business continuity

The Service runs on managed infrastructure (Cloudflare, Supabase) with their standard availability guarantees. Automated daily database backups are retained for 30 days. In the event the Service is discontinued, we will provide at least 30 days' notice and a final export window so you can download your data.

Reporting a vulnerability

If you believe you've found a security issue, please email hello@slpdraft.com with details and steps to reproduce. We will acknowledge within two business days. Please do not publicly disclose the issue until we've had a reasonable opportunity to fix it.

Contact

Security or compliance questions, or a DPA request? Email hello@slpdraft.com. See also our Privacy Notice, Terms of Service, and Refund Policy.