Security & Vulnerability Disclosure

Last Updated: June 11, 2026

The Advocate Ally handles sensitive education records. This page explains how to report a security issue, what data we treat as restricted, and the guardrails we use for uploads, reports, AI processing, vendors, and account access.

Report a Vulnerability

Send suspected vulnerabilities to security@theadvocateally.com. Include the affected URL or feature, steps to reproduce, likely impact, browser/device details, and screenshots or logs that help us investigate. Please do not access, download, modify, destroy, or share another person's data.

We aim to acknowledge security reports within 3 business days and provide status updates for validated issues as remediation progresses. For privacy requests that are not security vulnerabilities, contact privacy@theadvocateally.com.

What We Treat as Restricted Student Data

  • Uploaded IEPs, 504 plans, evaluations, prior plans, and other education records.
  • Extracted document text, AI prompts/responses tied to a document, generated audit reports, action plans, and advocacy drafts.
  • Student names, birth dates, disability labels, school history, services, goals, accommodations, findings, and report notes.
  • Access, export, deletion, support, and security logs that show who interacted with student-record workflows.

Core Security Guardrails

  • Uploaded records are designed to use private, access-controlled storage paths rather than public file URLs.
  • Generated audit details are designed to be encrypted before storage and accessed through authenticated application paths.
  • Sensitive report viewing, export, and deletion workflows require account authorization and additional guardrails such as email verification where available.
  • Support/admin access to student data is intended to be limited, logged, and tied to approved support, security, or operational need.
  • SMS, analytics, advertising, and routine operational logs are designed not to include raw IEP text, uploaded-file links, student names, disability labels, dates of birth, or report findings.
  • Security-sensitive pages and account pages are configured with restrictive browser headers and no-store caching where appropriate.

AI and Document Processing

Uploaded documents and extracted text are untrusted input. Our prompts and processing paths are designed so document text cannot override system instructions or trigger privileged backend actions. We also aim to minimize what is sent to AI providers and to avoid putting raw student content into telemetry, SMS, marketing, or support tooling.

We do not intentionally use identifiable uploaded student records to train public AI models. Institutional customers may request more detail about AI subprocessors, data handling settings, and any applicable written agreement before a school or district deployment.

Retention, Export, and Deletion

Raw uploaded documents are designed to be used for document review and then removed after processing or cleanup where available. Stale, failed, or orphaned upload objects may be subject to scheduled cleanup. Generated reports, action plans, account records, access logs, billing records, consent records, support records, privacy/security logs, backups, and institutional records may follow different retention periods based on legal, security, accounting, operational, or contractual needs.

Authenticated users can download available audit summaries or submit privacy requests in account settings. Broader access, deletion, correction, restriction, school, or district requests can be sent to privacy@theadvocateally.com. We may verify identity and may retain limited records where required or permitted.

Subprocessors and Vendors

The service may use Google Firebase/Google Cloud for hosting, authentication, storage, database, functions, task processing, and infrastructure; AI processing providers for document review; Stripe for payments; Twilio for SMS; SendGrid or SMTP providers for email; PostHog and analytics tooling for operational analytics, subject to privacy review and configuration; security/error-monitoring tools; and support tooling for privacy, security, and customer requests.

We do not sell student data. Contact privacy@theadvocateally.com for subprocessor information needed for a school, district, or institutional review.

We also design SMS, email, analytics, and conversion tracking so student names, disability labels, report findings, raw IEP text, raw upload links, and report content are not intended to be included in those channels.

Limits and User Responsibilities

No online service can promise perfect security. Users should protect account credentials, sign out on shared devices, upload only records they are authorized to submit, avoid pasting student details into support/privacy notes, and report suspected account or data exposure quickly.