Security
You are handing us your study material and your account. Here is what we do to look after both — and what we have not built yet.
Reporting a vulnerability
Email security@duckears.com with enough detail to reproduce the issue. We aim to acknowledge within two working days and to keep you updated until it is closed. We will not take legal action against good-faith research that avoids privacy violations, data destruction and service degradation. Please give us a reasonable window to fix things before publishing.
Data in transit and at rest
- All traffic is served over TLS 1.2+, with HSTS on our own domains.
- Databases and object storage are encrypted at rest by our infrastructure providers.
- Uploaded documents live in private storage buckets — never world-readable, never served from a guessable public URL.
Access control
- Row-level authorisation: a request can only ever read rows belonging to the authenticated user.
- Production access is limited to the people who need it, over multi-factor authentication, and is logged.
- Secrets live in a managed secret store, never in the repository.
Application security
- Passwordless and OAuth sign-in — we store no passwords ourselves.
- Rate limiting on authentication and upload endpoints.
- Strict security headers, and a content security policy on the application.
- Dependency and vulnerability scanning in continuous integration.
AI providers
Generating a course means sending document extracts to third-party model providers. We contract on terms that prohibit training on your content and require deletion after processing. We send the smallest extract that does the job, and never your account identifiers.
Backups and recovery
Databases are backed up daily with point-in-time recovery, and restores are tested. Uploaded files are stored redundantly.
What we have not done yet
We would rather tell you than let you assume. DuckEars is early: we do not hold SOC 2 or ISO 27001, we have not commissioned an external penetration test, and we do not yet offer SSO, audit-log export or a signed BAA. If your organisation needs any of those before it can adopt us, email security@duckears.com and tell us — it moves the roadmap.