Security at Scholiad

Passwordless by design.

There is no password on our side that could be leaked or reused.

• —Accounts are reached by a one-time sign-in link emailed to the account address.
• —Each link is single-use, time-limited (about 15 minutes), and rate-limited.

A session that can’t be lifted from the database.

• —Each session is keyed by a high-entropy random token generated server-side.
• —Only a one-way hash of that token is stored — never the token itself — so a copy of the database cannot be used to impersonate you.
• —Sessions end after a period of inactivity and carry a firm maximum lifetime. You can sign out of one session or sign out everywhere, taking effect immediately server-side.
• —The session cookie is HttpOnly (page scripts can’t read it), scoped to our own site, and sent only over an encrypted connection.

Hardened headers on every response.

• —The site can’t be embedded in another page, browsers don’t guess content types, referrer information is limited, and unused device capabilities (location, microphone, camera, payment) are switched off.
• —Responses instruct browsers to use an encrypted connection for an extended period (HSTS, 2 years).
• —Sign-in requests and AI-powered actions are rate-limited per account and per network address (HTTP 429 + Retry-After), so the platform stays responsive and resists abuse.

The AI reviews your draft. It never writes it for you.

This is the section institutions read most closely, so it is the most specific. Every claim here is a control enforced in code, not a policy promise.

You can see it, export it, and delete it.

Scholiad does not sell, rent, or trade personal or behavioral data to anyone.

Honest scope, plainly stated.

• —Scholiad is a Canadian corporation; its privacy practice is governed primarily by Canadian federal law (PIPEDA).
• —EU and UK users are extended GDPR rights — access, rectification, erasure, portability, restriction, objection — with a 30-day response commitment.
• —California users are extended CCPA rights. The opt-out-of-sale right does not apply, because we don’t sell data.
• —An append-only breach log is maintained (structurally immutable), and an incident-response process is in place — error-rate alerting and the breach log are live.

Where it runs, and what the vendors never see.

• —Hosting on a managed cloud platform with TLS terminated at the edge; data at rest is encrypted at the infrastructure level by the host.
• —Error monitoring drops the entire request body and cookies before a report is stored, and strips authorization headers and API keys — so a document draft never reaches the error-tracking vendor, even on a crash.
• —An automated security scanner runs in the build and blocks high-severity findings; a secret-scanning gate prevents credentials from being committed.
• —An AI-spend safety gate prevents any accidental or autonomous billed AI call from a non-consenting environment.
• —Health and readiness checks with automatic restart-on-crash keep the service available.

Found something? Tell the team.