Student data.
Protected at every layer.

All customer data is stored in Sydney, Australia, on AWS ap-southeast-2, via Supabase (managed PostgreSQL). Data is held in Australia under a data residency commitment and is not replicated, mirrored, or backed up to any non-Australian location. AWS Sydney is ISO/IEC 27001 certified and hosts data for Australian Government, banking, and university workloads.

Data at rest is encrypted with AES-256 (keys protected by FIPS 140-2 compliant HSMs). Data in transit uses TLS 1.2 or higher with modern ciphersuites on every connection: browser, app, and server-to-sub-processor. HTTPS is enforced on every endpoint; no unencrypted connection is accepted at any layer.

Writeiq runs a single PostgreSQL database shared across schools, with each school’s data isolated by PostgreSQL Row-Level Security (RLS) enforced inside the database engine itself, not by application code alone. Every read and write to school data also passes through a SECURITY DEFINER function that re-checks the user’s school against the data’s owner. Two independent controls; no school can ever see another school’s rows.

All public traffic routes through Cloudflare, which provides a Web Application Firewall (blocking SQL injection, cross-site scripting and request smuggling), DDoS mitigation at the edge, bot management, and rate limiting on sensitive endpoints (login, password reset). TLS is terminated at the edge and re-encrypted to origin. No school firewall changes are required: Writeiq is reachable on standard HTTPS port 443.

Every staff member has their own individual account. Staff email/password authentication is handled by Supabase Auth (Edsthetic never stores or sees a staff password), or staff sign in via their school’s Google Workspace or Microsoft 365 Single Sign-On (OAuth 2.0 with PKCE), where the school’s identity provider remains the source of truth and Edsthetic never sees the user’s Google or Microsoft password. TOTP multi-factor authentication is available to all staff and is mandatory for school administrators under the default policy. Historical note: the previous per-school shared-PIN and licence-key model has been retired for staff; staff now use per-user accounts.

Time-based One-Time Password (TOTP, RFC 6238) MFA is available for staff and works with Google Authenticator, Microsoft Authenticator, Authy, 1Password, and any compliant app. MFA is required for school administrators and optional for teachers at the school’s discretion. Schools using Google or Microsoft SSO automatically inherit any MFA policy enforced by their identity provider. TOTP secrets are stored AES-GCM-encrypted.

Students do not need email accounts, passwords, or SSO. Three school-controlled access paths are available: Class Links (recommended: a signed, school- and class-scoped URL or QR code that is itself the credential); Student Access Code (a school-set code typed once per device, rotated by the administrator); and optional Student SSO (opt-in per school for those with Google Workspace for Education or Microsoft Entra ID). The students table holds demographic data only: no password hashes, no TOTP secrets, no auth identity. Students never see other schools’, classes’, or students’ work.

Every sign-in attempt (successful or failed) is logged with timestamp, source IP, user agent, and authentication method. Every administrative action (creating an account, changing a role, removing a user, committing a bulk import) is also logged. The audit log is retained for at least twelve months and can be exported to a school’s IT or compliance team on request.

Automated daily backups are retained for 30 days, and point-in-time recovery is available for the last 7 days at five-minute granularity. All backups are encrypted with AES-256 and stored in the AWS Sydney region; they are never replicated outside Australia.

Pages are served with HSTS (2 years, includeSubDomains, preload), Content-Security-Policy, X-Frame-Options (DENY), X-Content-Type-Options (nosniff), Referrer-Policy (strict-origin-when-cross-origin), and Permissions-Policy. Session cookies are HttpOnly, Secure, SameSite=Strict, and host-scoped to app.writeiq.com.au; JWT session tokens are never written to localStorage or sessionStorage.

Supabase and Anthropic each commit to notify Edsthetic of a Security Incident within 48 hours of becoming aware. Edsthetic, in turn, commits to notify any affected school within 72 hours of confirmation; the 24-hour buffer allows scope to be investigated and accurate information assembled for the school’s response.

For an eligible data breach under the Privacy Act 1988 (Cth), Edsthetic complies with the Notifiable Data Breaches scheme, including notifying the Office of the Australian Information Commissioner (OAIC), and cooperates with any state Department of Education investigation.

Suspected incidents should be reported to security@edsthetic.com.au. We acknowledge security reports within four working hours during Australian business hours (next working day otherwise). Full detail is in our Incident Response Plan.

The full reference for school privacy and IT teams populating a PIA for Writeiq. Version 1.6, 12 May 2026. Download PDF →

Deletion triggers, timelines, and backup retention (30-day backup window, 7-day PITR). Aligned with APP 11.2. Read policy →

How we detect, contain, and notify on incidents. 72-hour school notification; OAIC under the NDB scheme. Read plan →

A practical guide for administrators, teachers, and support staff. Schools should ensure staff read it before first use. Read training →

The formal DPA governing processing of school data, signed before any paid contract. Download PDF →