How we handle your data
Plainly, including the parts we haven't built yet — a security page that only lists what sounds good isn't actually useful to you.
We never touch your students' card details
A centre connects its own Stripe account, and every student payment goes straight there — uInstructor is never in the payment path, never sees a card number, and never holds your students' money. See our pricing page for how the platform's own subscription billing works separately from that.
Encrypted in transit
Every page, on the platform site and on every centre's own subdomain or custom domain, is served over HTTPS with a real, auto-renewing TLS certificate — never plain HTTP.
API keys and integration secrets, encrypted at rest
When you connect your own Stripe key, an AI provider key, or another integration, we store it encrypted — not as plain text in our database. Once saved, a key is never displayed back to you or to us in plain text; you can only replace it, not read it back.
Passwords are hashed, never stored in plain text
Every account password is hashed before it's stored (bcrypt) — nobody at uInstructor, including us, can see or recover your actual password. Signing in with Google or Facebook skips passwords entirely.
Role-based access, scoped per workspace
A student, a teacher, a centre admin, and uInstructor's own platform staff each authenticate separately and only see what their role allows — a centre admin can't see another centre's data, and a student session can't reach admin actions, enforced on our servers, not just hidden in the interface.
What we don't have yet
Two-factor authentication isn't built yet, for any account type — it's on our list, not shipped. We also don't hold a formal security certification (SOC 2, ISO 27001, or similar); we're a small team and haven't gone through that process. If either of these is a hard requirement for you today, this isn't the right time to switch — happy to tell you honestly if that changes.
Found something that looks like a security issue? Email [email protected] with the details — mention it's a security report so it gets triaged first.