Security Overview
Security
This page describes the current Instagrity security posture at a practical level. It is designed to support teachers, schools, reviewers, and administrators who need a clear summary of the product’s hosting model, access controls, and current operational safeguards.
- Hosting model
- Vercel-hosted application with Supabase-backed authentication and data storage
- Access model
- Authenticated sessions plus role-based access boundaries
- Sensitive operations
- Admin tools, deleted-essay recovery, and premium overrides are role-restricted
- Review posture
- Descriptive public summary, not a certification or contractual audit report
Current architecture
Instagrity currently runs on Vercel for application hosting and uses Supabase for authentication and data services. The product separates major user areas by role, including public, student, teacher, and administrator surfaces.
Authentication and access control
Protected routes require an authenticated session, and major product surfaces are gated by role. Teacher workflows, student workflows, and admin workflows are intentionally separated so that users only see the areas relevant to their permitted role and class access.
Operational protections
Sensitive operations are restricted to appropriate roles. Examples include deleted-essay restore and permanent archive deletion, role changes, premium overrides, AI grading control, and audit-log visibility. Teacher access is further constrained by teacher-owned class relationships where applicable.
Student and classroom visibility
The current product is designed so that student-facing routes only expose the classes and assignments linked to the enrolled account, while teacher-facing routes expose classroom data for classes the teacher owns or manages. Students do not receive released results until assignment-level visibility settings allow it.
Vendors and supporting services
Current visible infrastructure includes Vercel for hosting, Supabase for authentication and storage, OpenAI for AI-assisted grading or feedback features when enabled, and Resend for email delivery workflows. Additional providers may be introduced as the platform matures.
Security review and school diligence
Instagrity publishes this page to make early security review easier for schools and districts, but schools remain responsible for determining whether the product meets their own security, procurement, data-processing, and contracting expectations. This public page should not be treated as a substitute for school-specific due diligence.