Security

Least-privilege access

The Google Classroom and Canvas connections are read-only. We don't request Google Drive.

Encrypted connections

Our websites and the app are served only over HTTPS.

Rules enforced on the server

Help levels, teacher permissions and transcript access are enforced on the server, so they can't be changed from a student's browser.

Logged access

When a teacher opens an excerpt of a flagged session, the unlock is recorded on the receipt.

Data minimization

Teachers work from summaries. Receipts don't quote students, and the class assistant can't read conversations.

Reporting a vulnerability

If you believe you've found a security issue, email saaj@coursewing.org with details. Please give us a chance to fix it before sharing it publicly. We'll acknowledge reports quickly and keep you updated.