Security & Student Privacy

Access to school records is controlled through authenticated accounts, roles, school membership, and feature permissions. Staff student-file access checks the requested student's school, and instructors using that workspace are restricted to their assigned students. Authorized platform administrators retain privileged administrative access.

Core student-file and enrollment database tables have row-level security enabled, alongside server-side authorization checks. These are layers of protection, not a substitute for careful account administration.

Student identity documents, enrollment documents, employee personnel files, and school resources are stored in private storage buckets rather than publicly accessible file folders. Document access is subject to the permissions and authorization checks for the relevant workspace.

Temporary download links may be issued after an access check. Treat these links as confidential: anyone who receives a valid link may be able to use it while access remains available. Do not forward document links, share screenshots of identity documents, or send identity documents through the public contact form.

Files downloaded to a computer or phone are also subject to that device's security and the recipient's handling practices. Schools should limit downloads to people who need them and protect any local copies.

Pilot Training Tracker is served over HTTPS. Our database and file-storage provider, Supabase, documents encryption in transit using TLS and encryption at rest using AES-256 for customer data. These infrastructure protections complement application access controls.

Encryption at rest does not prevent an authorized account from viewing a document. We do not describe school documents as end-to-end encrypted or claim that platform administrators can never access them.

Supabase security information

Two-step verification is available as an additional account protection. It is not mandatory for every account today. Staff student-file access checks an enrolled account's two-step verification status before allowing access.

Use individual accounts, strong unique passwords, and two-step verification where available. School administrators should review staff permissions regularly and remove access when someone no longer needs it.

Our Privacy Policy states that school training records are not sold and enrollment identity documents are not used for advertising. Hosting, authentication, storage, communications, analytics, and other enabled integrations can involve service providers. See the Privacy Policy for information about collection, use, sharing, and public-page advertising.

Schools should collect only the documents needed for their operations and applicable requirements, restrict access, and establish an appropriate retention process. Contact the school about corrections or retention of school-controlled records.

Read our Privacy Policy

Schools and university partners can contact us to discuss their security questionnaire, data-handling requirements, hosting, access controls, retention, recovery requirements, and service-provider review. Any institution-specific requirements should be evaluated and agreed in writing before relying on them.

This statement describes current controls. It is not an independent security audit or a guarantee of uninterrupted service. Pilot Training Tracker does not claim its own SOC 2 or ISO 27001 certification. A supplier's certifications do not certify the PTT application or establish compliance with an institution's legal obligations. No online system can guarantee absolute security.