Security and Responsible Disclosure

Security approach

1. Truvar.ai applies risk-based administrative, technical and physical safeguards to website, course and student information. Safeguards are reviewed as systems, risks and legal requirements change.
2. Public security wording must describe controls actually implemented. Do not claim a certification, audit result or compliance status such as SOC 2, PCI DSS, HIPAA or GDPR compliance unless the claim is documented, scoped and approved.

Core controls

• Role-based access and least-privilege permissions.
• Authentication controls and multi-factor authentication where supported.
• Encryption in transit and appropriate protection at rest.
• Controlled backups, logging, patching and access reviews.
• Vendor assessment and contractual security requirements.
• Incident response, containment, evidence preservation and notification procedures.
• Staff confidentiality and security awareness.

Responsible disclosure

1. Security researchers should report suspected vulnerabilities privately to security@truvar.ai with enough detail to reproduce the issue.
2. Researchers must avoid privacy violations, service disruption, social engineering, data destruction and access beyond what is necessary to demonstrate the issue.
3. Truvar.ai will acknowledge and assess good-faith reports. Permission to test is not granted merely by publication of this policy; written scope should be obtained before intrusive testing.

User responsibilities

1. Users must protect passwords, devices, email accounts and shared links. A user should report suspicious access promptly and must not share restricted learning materials or records publicly.