Security Statement
Hosting and infrastructure
NewPaths runs on a small set of established, independently certified cloud vendors, all located in the United States:
- Netlify hosts the website and our serverless backend functions.
- Supabase provides our managed PostgreSQL database, where account, roster, cohort, and saved-report data is stored.
- Anthropic provides the AI model, via its commercial API, that generates career analyses.
- Stripe processes the optional one-time payment and handles all card data directly (PCI-DSS compliant); we never receive or store full card numbers.
These providers maintain their own security certifications and controls. NewPaths inherits the physical, network, and platform security of this underlying infrastructure; the controls described below are those we implement at the application layer.
Data encryption
Data is encrypted in transit using HTTPS/TLS across the website, our API, and our connections to backend services. Data is encrypted at rest in our Supabase database. We do not export bulk data outside our infrastructure as part of normal operations.
Authentication
Counselor and advisor accounts use passwordless, magic-link authentication. When you request a sign-in link, a one-time token tied to your email is issued, and the resulting session token expires. We do not set or store passwords, which removes an entire category of credential-theft risk. Access to the founder/administrative dashboard is gated by a separate server-side secret.
Secrets management
All sensitive credentials — our AI API key, database service key, payment keys, and administrative secret — are stored as server-side environment variables and are used only within our serverless backend. They are never embedded in, or exposed to, the browser. The only key present in client-side code is a public, intentionally publishable database key whose access is constrained by server-side controls.
Access control and tenant isolation
Every request that reads or writes account, roster, or report data is authenticated server-side, and data is scoped to the requesting counselor or advisor and their organization. A counselor can see only the learners and reports associated with their own account; an organization's data is isolated from other organizations'. Cross-organization isolation is included in our automated test suite so that regressions are caught before release.
Internally, access to production data is limited to the operators who run the service, and is used only to provide and support the product.
Application security
- Output escaping. User- and model-generated content is escaped before it is rendered, to mitigate cross-site scripting (XSS).
- Server-side rate limiting. Requests to our API are rate-limited on the server to limit abuse and runaway usage.
- Usage spend cap. AI usage is bounded by a configurable monthly spend cap, providing a hard ceiling against abuse or error.
- Minimal data collection. The public assessment is designed to function without collecting names or emails; identifying information is requested only when a specific feature (sharing, an account, a payment) requires it.
AI and third-party data handling
To generate a report, we send Anthropic's API the career or major being explored, the assessment answers, and the selected region. We do not send Anthropic names or email addresses. Under Anthropic's commercial API terms, inputs and outputs are not used to train models by default, and we do not opt in to any training-data program. We do not sell or license assessment content. A current list of subprocessors is available to institutional customers on request.
Data retention and deletion
Retention is handled by category and is described in detail in our Privacy Policy. Institutional accounts and rosters are retained for the term of the license plus a short wind-down period for export, then deleted on request. Any individual or institution may request access to, or deletion of, their data by emailing grant@newpaths.ai.
Vulnerability management and responsible disclosure
We keep our dependencies and platform configurations current and review changes for security impact before release. If you discover a potential vulnerability or security issue, please report it to grant@newpaths.ai. We will acknowledge your report, investigate promptly, and keep you informed of remediation. We ask that you give us a reasonable opportunity to address an issue before any public disclosure.
Compliance posture and roadmap
In place today:
- Operation within FERPA's school-official exception for institution-licensed deployments, governed by a Data Processing Agreement.
- U.S. data residency across all infrastructure.
- The application-layer controls described above (encryption, passwordless auth, server-side secrets, tenant isolation, rate limiting, output escaping).
On our roadmap
As a small team, we are candid that the following are in progress rather than complete. We are happy to share current status with prospective institutional customers under NDA:
- Independent security assessment (e.g., a SOC 2 examination) and third-party penetration testing.
- Accessibility conformance — a Voluntary Product Accessibility Template (VPAT) documenting conformance with WCAG 2.1 AA.
- Formalized, periodically reviewed incident-response and business-continuity documentation.
For procurement and IT teams
If you are evaluating NewPaths for institutional use, we can provide, on request: a completed Higher Education Community Vendor Assessment Toolkit (HECVAT) questionnaire, a Data Processing Agreement, a current subprocessor list, and the current status of the roadmap items above. Please contact grant@newpaths.ai and we will respond promptly.