Security & Data Processing Agreement (DPA)

Technical safeguards & encryption

• TLS 1.3 is enforced for all data in transit across web interfaces and background processing APIs.
• Ephemeral in-memory processing: document structural analysis, tag synthesis, and OCR streaming operate in isolated container memory without persistent caching of source document bodies.
• Production access is restricted under least-privilege role-based access controls (RBAC) and protected by multi-factor authentication (MFA).
• Signed, time-limited URLs are used for retrieving remediated outputs, expiring automatically after verification windows.
• Continuous automated vulnerability monitoring, dependency scanning, and active edge rate-limiting to prevent unauthorized access.

FERPA & student data protection

ADAFix is built specifically for public-facing course syllabi, lecture notes, academic handouts, and institutional documents. We do not require, request, or knowingly process Student Education Records protected under the Family Educational Rights and Privacy Act (FERPA).

Instructors and institutional staff are instructed never to submit student grade books, identifiable student submissions, IEP plans, or private student communications. If an institution requires additional legal safeguards, our enterprise DPA incorporates standard FERPA school-official clauses where applicable.

Data retention & ephemeral disposal

Uploaded source PDFs and remediated output files are stored temporarily solely to allow user review and download. Files are scheduled for automatic permanent deletion from intermediate storage within 24 to 72 hours of job completion.

Compliance metadata retained in the user dashboard is limited to operational non-content records: job timestamps, page counts, detected issue categories, and pass/fail check summaries. Users or institutional administrators may request complete tenant deletion at any time.

Data Processing Agreements (DPA)

Higher education institutions, school districts, and government agencies with formalized procurement requirements can request our standard Data Processing Agreement (DPA).

Our DPA covers subprocessor disclosures, SOC 2 Type II hosting controls, technical security measures, standard contractual clauses (SCCs), and defined data deletion obligations. Contact support@useadafix.com or submit a request through our procurement contact portal.

Report a security vulnerability

We value the research community and take security reports seriously. Please report suspected vulnerabilities privately to security@useadafix.com with reproducible details. Do not access or modify customer data, and provide reasonable time for remediation prior to public disclosure.