What Glassability holds, and never holds
Course content: pages, files, images, captions, and what Glassability changed in them, with a copy before and after. An encrypted token that acts as the instructor who connected a course. Never student submissions, grades, enrollments or the people in a course. The privacy page has the detail.
Where it is kept
- In the United States. The service runs on a server we operate in a United States data center, behind Cloudflare's network.
- Backed up nightly to storage we control in the United States and kept for fourteen days, with weekly copies of the whole server kept for four weeks.
- Restorable elsewhere. The service has been restored from its backup onto a new server in another region and checked; the plan allows 30 minutes, and at most one day of changes is at risk.
How it is protected
- In transit: HTTPS on every address, end to end, with browsers told to use nothing else.
- At rest: the tokens that act for instructors are encrypted everywhere they are kept (AES-256-GCM): on the server with a key only the service can read, and on the scanning engine in an encrypted credential vault whose key is protected by the operating system.
- Private addresses: each course's report opens only at its own unguessable address, and those addresses are never sent on to other sites. An administrator who opens Glassability from Canvas sees only their own part of the institution.
- Canvas enforces the limits. A college may turn on scope enforcement for Glassability's Canvas key; Canvas then refuses anything outside the list of what Glassability uses, which the college's Canvas administrator receives with the installation instructions and which never includes student records.
- Administration of the server is by the founder only, over a private network that requires multi-factor sign-in, then by key, never by password. No administrative port is open to the internet: the server answers the public only on the web, through Cloudflare.
- AI: no student data can reach any model, because Glassability holds none; course content is never used to train a model. What the AI sees.
Who else handles data
| Service | What for | What it sees |
|---|---|---|
| DigitalOcean | The server, in the United States | Everything Glassability holds, stored on its hardware |
| Cloudflare | The network in front of the server | Traffic to and from the service, encrypted end to end |
| Email for support and sales | What a person writes to us | |
| Tailscale | The private network we administer the server through | Which of our own machines are connected; not the traffic, which is encrypted end to end |
| Google Gemini, OpenAI, Anthropic | The tasks they do better (describing images first), and checking the work | Course content the task needs, under a data processing agreement, with no training; never student data |
The list of frontier providers may change: we may add or remove one with 14 days' written notice to the colleges we serve, and only for a provider with a data processing agreement in place that processes the college's content in the United States.
If something goes wrong
If data a college entrusted to Glassability is exposed or used without authority, we tell the college as soon as we can, and no later than 24 hours after we discover it or have reason to believe it happened, even before we know everything: what happened, what data, what we have done, and what the college may need to do. Updates follow as we learn more. A wrong change in a course is reversed from its saved copy first; see support.
Not done yet
- No independent audit (such as SOC 2) yet. The questionnaire answers are ours.
- The scanning engine runs on hardware we operate in a private office. Tokens there are kept in an encrypted vault, but the engine's working copies of course content are not yet encrypted. A dedicated engine with encrypted storage is planned.