Security at SensAI

SensAI runs the day-to-day operations of studios and schools — student records, billing, attendance, and family contact details. We treat that data as sensitive by default and build our platform around keeping it private, available, and yours.

Infrastructure

SensAI is built on managed, industry-standard cloud infrastructure (Supabase/PostgreSQL for data, Cloudflare for application delivery, Stripe for payments). These providers maintain SOC 2 / ISO 27001-class compliance programs and operate hardened, continuously patched environments. We do not run our own physical servers.

Encryption

• In transit: all traffic to and from SensAI is encrypted with TLS 1.2+.
• At rest: databases and backups are encrypted at rest by our infrastructure providers.
• Payment data: card details are handled directly by Stripe and are never stored on SensAI servers.

Tenant isolation

Every studio is a separate tenant. Data access is enforced at the database layer with row-level security: a request can only read or write rows belonging to an organization the authenticated user is a verified member of. This isolation is enforced by the database itself, not just by application code, so one studio can never see another studio's data.

Access & authentication

• Sign-in supports email magic links and Google sign-in; passwords (where used) are hashed, never stored in plain text.
• Staff and member roles are scoped — members can only access their own family's records, never the full roster.
• Internal administrative access to production data is limited to the minimum personnel required to operate and support the service.

Payments

Member billing runs on Stripe. SensAI never sees or stores full card numbers; sensitive payment credentials live exclusively within Stripe's PCI-DSS Level 1 environment. Studios connect their own Stripe account, so payouts go directly to the studio.

Backups & availability

Data is backed up automatically by our database provider with point-in-time recovery. The platform is delivered through a global edge network for resilience and uptime.

Your data is yours

We don't sell your data or your members' data, and we don't use it to train third-party advertising models. You can export your studio's data at any time, and we'll delete it on request when you leave.

Reporting a vulnerability

If you believe you've found a security issue, please email us at security@buysensai.com. We investigate every report and appreciate responsible disclosure.