At a glance

What we do, in one screen.

Sub-processors

Who else processes your data.

We disclose every third-party service that touches account or payment data. Districts on a written contract receive 30 days' notice before any new sub-processor is added.

Authentication

How sign-in works.

• Three sign-in modes: email + password, magic link (one-time email link), and OAuth (Google/Microsoft). Districts can request that password-mode be disabled for their tenant.
• Password storage: bcrypt hashes with a per-hash salt. Plaintext passwords are never stored, logged, or transmitted server-side after the initial request.
• Sessions: Auth.js v5 JWT-backed sessions with rolling expiration. Sign-out invalidates the session cookie immediately.
• Brute-force defense:sign-up endpoint is rate-limited per IP. Sign-in attempts are logged in the audit trail.
• Account deletion: a user may delete their account from the dashboard. Deletion removes personal data and anonymizes audit-log entries within 30 days.

Student data

Data minimized for classroom use.

Student accounts and progress tracking are current platform capabilities. Schools direct classroom use and can request an export or deletion, subject to legal and credential-record needs.

• Student Data Privacy Agreement: available for districts on request using an NDPA-compatible framework.
• Data minimization:student records store account identity, class enrollment, lesson and module progress, assessment activity, scores, credentials, and appeals. We do not require DOB, SSN, or demographic data.
• FERPA / COPPA alignment:student data is collected for school-directed educational use, with the school controlling enrollment and classroom access.
• Deletion on request:districts can request bulk deletion or export of student data, subject to applicable legal and credential-record requirements.

AI and certification integrity

Limited inputs, human decisions.

• Lesson voice: when invoked, relevant lesson context and the user's narration request or question are sent to xAI to generate text and audio.
• BB-CCA telemetry: v1 records focus, visibility, fullscreen, copy/paste-attempt, navigation, answer-change, question-view, timing, sequence, and coarse hashed device-class events. It does not capture webcam, microphone, screen images or video, clipboard contents, keystrokes, page titles, or browsing history.
• Retention: raw integrity telemetry is deleted after 90 days. Reviews, appeals, audit records, and credential status are retained separately.
• Advisory AI: deterministic signals and xAI summaries assist reviewers. AI does not change exam scores or decide credentials; authorized humans make those decisions. Adverse decisions may be appealed within 14 days.

Incident response

What happens if something goes wrong.

• Reporting: security researchers and customers can email security@blackboxintelgroup.com with reports. We acknowledge within 2 business days.
• Containment: on confirmed incidents, we rotate affected credentials, take the affected surface offline if needed, and preserve evidence (audit log, server snapshots).
• Customer notification:customers whose data is implicated are notified within 72 hours of confirmation. District contracts spell out the notification chain in detail.
• Post-mortem: we publish a redacted post-mortem on the changelog for any incident that affected service availability or data confidentiality.

For procurement

Documents we can sign.

• Data Processing Addendum (DPA) — available on request for District License customers.
• Student Data Privacy Agreement (NDPA) — available on request for student-account deployments.
• W-9, certificate of insurance, sub-processor list — available immediately.
• Custom security questionnaires (HECVAT, K-12 SIG, district-specific) — typical turnaround is 5 business days.