Security
How Pathfinder protects your information, and where it currently falls short.
How Pathfinder protects student data: authentication, data in transit and at rest, role-based access controls, AI data handling, and how to report a vulnerability.
Sign-in
Authentication is handled by Clerk. Pathfinder never stores your password. Session verification runs on the server for every authenticated API request.
Access controls
Every API request is checked against the caller role — student, counsellor, admin, guardian or partner — before a handler runs, and student data is scoped to the signed-in student.
Data in transit and at rest
Traffic uses HTTPS. Application data is stored in a managed Postgres database. This page is a description of controls, not a certification.