Security at UnisPath.
Schools and counseling teams trust us with sensitive student information — transcripts, test scores, reference letters, application history. We treat that trust as our most important product feature.
Encryption in transit and at rest
All traffic is served over HTTPS (TLS 1.2 or higher) through Google's load balancer, behind the Google Cloud Armor web application firewall. The database has no public address. Application data, uploaded documents, database backups, and API credentials are encrypted at rest with Google-managed keys on Cloud SQL, Cloud Storage, and Secret Manager.
Role-based access control
Students, organization staff, and UnisPath administrators each see only what their role allows. Organization staff are Admins or read-only Viewers, and each organization's owner decides, person by person, what they may do — including whether they see every student or only the students assigned to them. Every check runs on the server, on every request.
Tenant isolation
Every student record carries its organization, and every query for students — and for their applications, documents, and messages, which are reached through the student — is filtered to the caller's organization on the server, so one organization can't see another's records.
Audit logging
Infrastructure access, permission changes, and administrative operations on our cloud project are recorded by Google Cloud Audit Logs. Application stage changes are recorded with who made them and when.
Incident response
If we confirm a security incident affecting customer data, we notify affected organizations without undue delay and in any event within 72 hours, and follow up with a written post-incident summary.
Backups and recovery
The database is backed up daily, with seven days of point-in-time recovery. A replaced or deleted document stays recoverable for 7 days, so a mistake can be undone, and is then permanently deleted — so the erasure we promise actually happens.
Reporting a vulnerability
If you believe you've found a security issue, please email us and give us a chance to fix it before telling anyone else. We will acknowledge your report within 3 business days. Please don't access other people's data, disrupt the service, or run automated scans against it.
security@unispath.comAlso published at /.well-known/security.txt.