Explica Security

How Explica protects student and teacher data. Written for the person in a school who has to sign off on it.

Last updated: 23 September 2026

Authentication

• Sign-in is Google OAuth only. Explica never sees, receives, or stores a password.
• Sessions are signed tokens (30-day expiry) held in the browser — chrome.storage for the extension, localStorage for the web app.
• AI provider keys live on the server only. No key is ever sent to a browser, so no student holds one.

Access control

• Every API route requires a valid session.
• A teacher can read rosters, submissions and analytics only for classes they own. This is checked on the server against the class's owner on every request, never trusted from the browser.
• School administrators are scoped to their own organization and cannot see another school's data.
• Platform-operator access comes from an environment variable, not from the database. It cannot be granted through the application by anyone, including a school administrator.

These boundaries are verified by an automated suite that attempts to cross each one — one tenant reaching another's classes, submissions, documents, invitations, licences and billing — and fails the build if any attempt succeeds. It currently runs 66 such checks.

Domain claiming

Claiming an email domain would otherwise let one person absorb everyone at a school. Three controls:

1. Your sign-in address must be at the domain you are claiming.
2. Public email providers (gmail.com, outlook.com and similar) can never be claimed.
3. A claim grants nothing until it is verified — by a DNS TXT record, which only whoever controls the domain's DNS can publish, or by manual approval.

Student data

• A student's lookup history, saved words and progress are readable only by that student. Teachers see class activity through a class they own — never another teacher's class, and never a student's private practice writing.
• Private practice writing never reaches our servers. It stays in the browser.
• Assignments can be completed entirely in the web app, so a device that cannot install browser extensions can still do coursework. The extension adds explanations on other websites; it is not required for anything a teacher sets.

Reading activity

When a teacher sets a reading, Explica records active time, which pages were spent on, and how many words were looked up. It records nothing else: no keystrokes, no screen contents, no camera, and nothing about any other tab or application. Time accrues only while the reading is focused and being interacted with, so a tab left open in the background records nothing.

These are engagement signals shown to the teacher. They are explicitly not treated as proof that a student did or did not read something.

Paste detection

Pastes of 25 characters or more into an Explica assignment editor are recorded — the size, the count, and the pasted text, so a teacher can see what was pasted rather than only that a paste happened. It is captured only inside the Explica assignment editor: never from other pages, other applications, or the clipboard generally, and only while a student is pasting into their own assignment. It is visible only to the teacher who owns that class.

Uploaded documents

• Stored under a random name, never the uploaded filename.
• Parsed and validated as a genuine PDF before being stored — the declared file type is not trusted.
• Capped at 25 MB, with parsing run with script evaluation and external resource fetching disabled.
• A class reading is served only to members of that class. A personal reading is served only to the person who uploaded it — not to their teacher.

Abuse and cost controls

Per-user limits cap requests per minute and per day, so a stolen session cannot run up an unbounded bill or hammer the service. Requests are refused above the limit rather than queued.

Backups and durability

The database is backed up nightly, and each backup is copied to separate, off-site storage so the loss of a single machine is recoverable. Every off-site copy is read back and checked against what was sent before it counts as successful.

Deletion

Deleting a class permanently removes its assignments, submissions, reading activity and uploaded PDFs in one transaction, including the files on disk. Deleting an account removes that person's lookup history and writing.

Retention windows are enforced by an automatic daily job, not by manual cleanup. They are listed in the Privacy Policy.

Reporting a vulnerability

Email security@explica.app. We aim to acknowledge within two business days.

Please give us a reasonable chance to fix an issue before disclosing it publicly. We will not pursue legal action against anyone acting in good faith to find and report a genuine security problem.