Security & Data Practices

• Passwords are hashed with PBKDF2 and never stored in plain text.
• Sessions use signed cookies with expiry.
• Account deletion removes account data from our primary storage.

• Connections use OAuth. Aluma never sees or stores your school password.
• OAuth tokens are encrypted at rest and used only to read the scopes you authorized.
• Aluma does not write into your school documents or submit assignments on your behalf.
• You can disconnect any connector at any time from Settings.

• Hosted on Cloudflare with DDoS protection and TLS in transit.
• Application data stored in managed Postgres with encryption at rest.

• Tutoring replies are generated using third party model providers, currently Anthropic's Claude API. Your messages are sent to the provider to produce responses, subject to their terms.
• Aluma does not use your private conversations to train models.

• Anthropic — model inference (Claude API).
• Stripe — payment processing.
• Cloudflare — hosting, CDN, DDoS protection.
• School and productivity platforms you connect (Google, Canvas, Schoology, Blackboard, Notion, and others) — scoped to what you authorize.

Aluma is responsible for the platform controls above. Students and families are responsible for the accounts they choose to connect, the content they upload, and keeping their login credentials safe.

Please report suspected security issues to security@aluma.fun. We aim to acknowledge reports within a few business days.

Aluma does not currently hold independent security certifications such as SOC 2 or ISO 27001. As the company grows we plan to pursue relevant certifications and will publish updates here.