Trust Center
Security and privacy at Built To Pass
How we protect learner data, who else touches it, and how to reach us about a security concern.
Application security
All traffic is served over HTTPS with HTTP Strict Transport Security enforced for one year across all subdomains.
Every route carries a full set of security headers, including a Content Security Policy that restricts script and frame sources to an explicit allowlist, and a frame-ancestors policy that blocks clickjacking.
Passwords are hashed with bcrypt. Session tokens are held in HTTP-only cookies and are never readable by client-side JavaScript.
Payment card details are collected directly by Stripe and never reach our servers.
Data security
Learner records live in a managed PostgreSQL database with row-level security enabled on every table, which keeps the public data API closed by default.
Data is encrypted in transit and at rest by our hosting and database providers.
Access to production systems is limited to named administrators.
Security-relevant actions, including sign-ins, failed sign-ins, and administrative changes, are written to an audit log.
How we keep it that way
The controls above are enforced by an automated check that runs on every code change and on a weekly schedule. A change that weakens a security header, exposes a credential, drops a required policy page, or introduces a critical dependency vulnerability fails the build and does not ship.
Dependency advisories are reviewed weekly, not only when we happen to deploy.
Account protection
Each account is limited to a set number of active devices, which limits the damage from a shared or stolen credential.
Sign-in attempts are rate limited.
Course video is embed-only and domain restricted, with no downloadable source files exposed.
Who else touches your data
These are the services we rely on to run the platform. We do not sell personal information. Last reviewed 2026-08-05.
| Service | Purpose | Learner data |
|---|---|---|
| Vercel | Application hosting, edge network, and CDN | Yes |
| Supabase | Managed PostgreSQL database (hosted on AWS) | Yes |
| Stripe | Payment processing for enrollments, subscriptions, and AI top-ups | Yes |
| Resend | Transactional email delivery (account, receipts, notifications) | Yes |
| Anthropic | AI study coach and practice question generation | Yes |
| Vimeo | Video hosting and playback for lesson content | Yes |
| OAuth sign-in, Google Analytics, and Google Fonts | Yes | |
| Meta | Advertising pixel on marketing pages | No |
| Cloudflare | Turnstile bot protection on public forms | Yes |
Reporting a vulnerability
If you believe you have found a security issue, email partners@getbuilttopass.com. We will acknowledge your report and keep you updated while we investigate. Please give us a reasonable window to fix the issue before disclosing it publicly. Our machine-readable contact is published at /.well-known/security.txt.
Documentation for buyers
Districts, universities, and agencies frequently need a completed security questionnaire or a data privacy agreement before purchase. Email partners@getbuilttopass.com and tell us which form your procurement team uses. See also our Privacy Policy, Terms of Service, and Accessibility Statement.