Trust & Security
How we protect your information. Last updated June 11, 2026.
Our approach
VidaRise is a private community for an academic program. Member information is visible only to verified, approved members — nothing is public. We built the platform around the Family Educational Rights and Privacy Act (FERPA) and our partner institution’s security standards from the start, and we hold ourselves to the stricter of the two.
What we hold — and don’t
We collect only what members provide about themselves: name and contact details, educational and professional background, military service (if voluntarily shared), career goals, profile text and photo, and survey responses. We also keep limited security telemetry (IP address, audit logs).
We do not collect Social Security numbers, financial or payment information, health records, or government IDs. We do not store passwords — sign-in is by one-time email code or Google.
How we protect it
- Deny-by-default access controls (row-level security) enforced at the database, so members only ever see what they’re approved to see.
- Encryption in transit (TLS/HTTPS) and at rest (AES-256).
- Private photo storage — event photos are never publicly addressable and are served only through short-lived, server-signed links. Uploaded images are re-encoded server-side, which removes embedded location metadata.
- Append-only audit logging of access to and export of education records.
- Versioned, revocable consent recorded before your data is used.
- Security headers, rate limiting, and bot protection on authentication, plus input validation and sanitization.
- Daily automated backups.
No system is perfectly secure. If we become aware of a breach affecting your records, we will notify you and our institutional partner promptly, in accordance with applicable law.
Where your data lives
All primary data is stored and processed in the United States (database, authentication, and file storage are hosted on Supabase, running on Amazon Web Services in the US East / Ohio region). We do not knowingly store data outside the US.
Service providers (sub-processors)
We rely on a small set of vetted providers to operate the platform:
- Supabase (on AWS) — database, authentication, and file storage.
- Vercel — application hosting and content delivery.
- Resend — sending invitation and notification email.
- Cloudflare Turnstile — bot protection on sign-up.
- Google — optional sign-in and event-address autocomplete.
These providers access your information only as needed to perform their service and are contractually bound to protect it.
Your rights and contact
Under FERPA and our policy you may inspect and review your records, request corrections, control directory visibility, and revoke consent at any time from your profile settings. Full details — including how to exercise these rights and who to contact — are in our Data Use Policy.