Compliance & Security

Information for school IT, privacy, and procurement teams evaluating ProofReady for a pilot.

Last updated: 22 April 2026

1. Service overview

ProofReady is a web-based formative-feedback tool that generates AI feedback on student assessment drafts. It is aligned to the NSW HSC syllabus and produces:

• A validated evidence map with exact strengths and one to three ordered revision actions.
• Criterion alignment against the teacher's visible marking criteria.
• Short, linked annotations on exact quotes from the student's own draft.

ProofReady does not award marks, replace teacher judgement, act as a reporting mechanism for welfare concerns, or replace any school assessment policy.

2. What we collect

Category	Examples	Who provides it
Account data	Display name, email, role (student/teacher), hashed password	User at sign-up
Task data	Task title, question, criteria, teacher notes, 6-character task code	Teacher
Submission content	Draft text and associated metadata (draft version, timestamp)	Student
Generated feedback	AI-produced feedback, criterion commentary, inline annotations	Generated by ProofReady
Technical data	IP address, request timestamps, browser user-agent, error logs	Captured by our platform for security & debugging

We do not intentionally collect sensitive personal information (health, religion, political opinions, etc.). Users are asked in the Terms & Conditions not to include such information in drafts beyond what the academic task strictly requires.

3. Sub-processors & data residency

ProofReady relies on four providers. Each handles only the data it needs for its role and is bound by its own published terms.

Provider	Role	Data handled	Region
OpenAI	Primary AI provider for feedback and analysis	Task question + criteria + the submitted draft. No account data.	United States
Anthropic (Claude)	Specialist maths verification and controlled fallback AI provider	Task question + criteria + the submitted response when that path is used. No account data.	United States
Supabase	Authentication & managed PostgreSQL database	All account, task, submission, and feedback data at rest	Oceania (Sydney), Australia
Vercel	Application hosting & content delivery	HTTP traffic (transient), request/access logs	Global edge network; application functions are pinned to Sydney

Current residency position: Since 25 July 2026, ProofReady's application functions and its Supabase authentication, database and stored-file project have been provisioned in Sydney. OpenAI and Anthropic operate outside Australia and process the limited submission content described above when their respective AI paths are used, so overseas-disclosure obligations still apply.

We also load Google Fonts from Google's CDN for typography. No user data is transmitted to Google beyond what is inherent in loading a public stylesheet (IP, user-agent).

We will notify schools in writing if we change or add a sub-processor.

4. Security practices

• Encryption in transit — all traffic served over HTTPS/TLS 1.2 or higher.
• Encryption at rest — database storage is encrypted by our managed provider (Supabase on AWS).
• Row-level security — database policies enforce that a student can see only their own submissions and a teacher can see only submissions to tasks they own, regardless of the credential presented by the client.
• Password storage — passwords are never stored in plain text; hashing is handled by Supabase Auth.
• Principle of least privilege — admin access is limited to named operators.
• Rate limiting & abuse protection — per-user and global daily limits are enforced on the feedback endpoint to prevent automated abuse and runaway cost.
• Dependency hygiene — security updates are applied regularly to third-party libraries.

5. Authentication

• Method: email + password authentication via Supabase Auth.
• Password reset: self-service via an emailed magic link.
• SSO: not currently supported; available on request for larger pilots (Google Workspace for Education, Microsoft 365).
• MFA: not currently enabled for end users; available on request.
• Sessions: short-lived JWT access tokens with refresh tokens, managed by Supabase.

6. Minors & school authorisation

ProofReady is used by secondary school students, many of whom are under 18. When a school pilots ProofReady:

• The school is the authorising body for student use. The school is responsible for obtaining any parental or guardian consent required under its own policies.
• Students should only use ProofReady under the direction of a teacher who has created the relevant task.
• Teachers' existing obligations under NSW Child Protection procedures and the Children and Young Persons (Care and Protection) Act 1998 (NSW) are not altered by use of the platform. ProofReady is not a reporting mechanism.
• The Terms & Conditions instruct students not to include disclosures of harm, abuse, or safety concerns in their drafts, and to use the supports listed (Kids Helpline, Lifeline, 000) or a trusted adult at school for those matters.

7. AI usage & training

• OpenAI is ProofReady's primary AI provider during the pilot. Anthropic is retained for specialist maths verification and controlled fallback paths.
• API inputs and outputs are not used to train either provider's models by default. See OpenAI's API data controls and Anthropic's privacy information.
• ProofReady sends OpenAI Responses API requests containing student data with store: false. Providers may still retain limited abuse-monitoring data under their published API terms, normally for up to 30 days unless legal or safety exceptions apply.
• ProofReady does not train or fine-tune any model on user submissions.
• ProofReady uses submissions only for the student-feedback and authorised, scope-checked staff-insight purposes described in the Privacy Policy. It does not use submissions for advertising or model training.

8. Breach notification

In the event of a data breach that is likely to result in serious harm to affected individuals, we will:

• Notify affected users within 72 hours of confirming the breach.
• For pilot schools, notify the nominated school contact within the same timeframe.
• Notify the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme.
• Provide a written description of the breach, the data involved, and the steps users and the school should take.

9. Data retention & deletion

• Account and submission data is retained while a user's account is active.
• On account deletion (by the user, by the school, or at end of pilot), personal data is deleted or de-identified within 30 days.
• Short-term operational logs (error logs, access logs) are retained for up to 90 days.
• Deletion requests can be made at any time by emailing help@proofready.app.
• A school administrator ending a pilot can request bulk deletion of all accounts and submissions associated with the school.

10. Data Processing Agreement

For pilots that require a signed Data Processing Agreement (DPA), we can provide one on request. In most cases a simple exchange of letters is sufficient for a pilot; for larger or longer deployments a full DPA is available.

The DPA covers:

• Roles (ProofReady as processor; the school/teacher as controller of student data).
• Purpose of processing (generating formative feedback on drafts).
• Categories of personal data and data subjects.
• Obligations regarding confidentiality, security, sub-processing, and breach notification.
• Return or deletion of data at the end of the engagement.

11. Contact & support

For compliance, security, procurement, or privacy enquiries:

• Email: help@proofready.app
• Privacy Policy: /privacy.html
• Terms & Conditions: /terms.html