Beginner Investor Hub
How we protect your data — and your institution's members. Built on the principle that the safest data is data we never needed to collect.
Learner progress, educational metrics, and institutional reporting are safeguarded with strict architectural boundaries. All service interactions are strictly governed by encrypted APIs with role-based access controls (RBAC) to ensure complete data integrity and confidentiality.
Each institutional partner operates in a fully isolated tenant environment. User data, learning progress, and reporting are scoped to the tenant at the database level — not just the application layer.
We store only email address and learning progress. No account numbers, no balances, no transaction history, no Social Security Numbers, no financial account data of any kind. We cannot expose what we do not hold.
| Control | Our Approach |
|---|---|
| Authentication | Bank-controlled SAML SSO with just-in-time provisioning. Users de-provisioned automatically on removal from your IdP. |
| Encryption at rest | AES-256 across all production databases and storage. |
| Encryption in transit | TLS 1.3 enforced on all connections. Older protocols rejected. |
| Access controls | Production DELETE privileges fully revoked. Role-based access enforced at service boundaries. |
| Backups | Daily encrypted snapshots with tested restore procedures and documented RTO/RPO targets. |
| Incident response | 24-hour notification SLA to institutional partners for critical incidents. Written response playbook available on request. |
| Vulnerability management | Dependency scanning integrated into CI/CD pipeline. Critical CVEs patched within 72 hours. |
| Security alignment | Platform architecture designed around industry-standard Security, Availability, and Confidentiality principles with robust defense-in-depth controls. |
We maintain a short, auditable subprocessor list. All subprocessors are contractually bound to equivalent data protection standards through signed Data Processing Addendums (DPAs).
| Subprocessor | Purpose | Location | Agreement Link (DPA) |
|---|---|---|---|
| Google Cloud Platform | Infrastructure, databases, storage | USA | GCP DPA → |
| Firebase | Authentication | USA | Firebase Data Terms → |
| Vertex AI | AI tutoring models | USA | Vertex AI terms → |
| Stripe | Payment processing | USA | Stripe DPA → |
To report a vulnerability, request our Data Processing Agreement, or submit a vendor security questionnaire, contact our security team directly.
security@beginnerinvestorhub.comWe acknowledge all security reports within 24 hours.