growgrader← Back to Home

Data Processing & Security Policy

Last Updated: July 2026

At GrowGrader, security is not an afterthought. Because we process academic performance data and recruitment pipelines, we adhere to stringent enterprise security standards. This document outlines our data processing infrastructure and security protocols.

1. Infrastructure & Architecture

GrowGrader is deployed on a modern, serverless edge architecture designed for maximum isolation and resilience.

  • Hosting: The frontend and serverless API routes are hosted on Vercel's global Edge Network, ensuring DDoS protection and encrypted transmission.
  • Database: All persistent data is stored in Supabase (PostgreSQL), utilizing strict Row Level Security (RLS) to guarantee tenant isolation. A Student cannot access another Student's data, and an Institution cannot access data belonging to a different Institution.

2. Data Encryption

Encryption in Transit

All communications between your browser, our Edge network, and our Supabase database are encrypted using TLS 1.2 or higher (HTTPS). We enforce Strict Transport Security (HSTS).

Encryption at Rest

All databases and storage buckets (including uploaded resumes and profile pictures) are encrypted at rest using AES-256 encryption.

3. AI Data Processing (Google Gemini)

GrowGrader uses Google Gemini as its core AI engine. To protect Student and Institution privacy, we implement a strict Zero PII (Personally Identifiable Information) Payload Policy.

When a student submits code for evaluation:

  • The code payload is stripped of the Student's name, email, and ID.
  • An anonymized payload containing only the code and the technical task requirements is sent to the Gemini API.
  • The AI generates a grading rubric and feedback string.
  • The feedback is mapped back to the Student internally within our secure database.

Google does not use API payloads to train their foundational models. Your proprietary tasks and student submissions are not leaked into public AI models.

4. Incident Response

In the event of a confirmed data breach involving Personal Data, GrowGrader will notify affected Institutions and relevant regulatory authorities within 72 hours of becoming aware of the incident. We will provide a summary of the breach, the data compromised, and our immediate remediation steps.