Security & Compliance
Security, privacy, and compliance controls for Academe research workspaces.
Customer data is not used for model training
Research content is sent only when needed to provide the feature being used.
Encryption in transit and at rest
Traffic uses TLS and stored customer data is encrypted by the underlying services.
Role-scoped access
Organization access is scoped by role, with separate paths for collaborators and billing admins.
Review materials available
Team and Enterprise customers can request reports, questionnaires, and contracting documents.
Contents
Overview
Academe is built for research materials that may be private, unpublished, or institutionally sensitive. We treat security as part of the product surface, with documentation and controls that can be reviewed during procurement or security review.
Multi-factor authentication
Users can enable multi-factor authentication (MFA) on their Academe account for an additional layer of security beyond passwords. MFA adds a second verification step during sign-in and reduces the risk of unauthorized access if a password is compromised.
SOC 2 Type II
Academe maintains SOC 2 Type II controls for security, availability, and confidentiality. Team and Enterprise customers can review the current report under NDA.
Enterprise and Team customers can request the report by emailing hello@academe-ai.com.
HIPAA
Academe supports HIPAA-regulated research workflows under a Business Associate Agreement (BAA). Protected Health Information (PHI) should only be stored on Academe after the BAA is in place.
Enterprise customers can request to sign a BAA by emailing hello@academe-ai.com.
Data encryption
All customer data is encrypted at rest using AES-256 and in transit via TLS. Sensitive material such as access tokens and user-provided API keys (BYOK) is additionally encrypted at the application layer and stored via Supabase Vault.
Role-based access control
Organization members can be granted fine-grained access to specific resources within Academe. Roles include read-only access for collaborators who only need to view data, and billing-only roles for administrators who manage subscriptions without accessing research content.
Backups
Paid customer databases are backed up daily. Point-in-time recovery supports restoration within the available recovery window if accidental deletion or unexpected infrastructure issues occur.
Payment processing
Academe uses Stripe to process payments and does not store personal credit card information on its servers. Stripe is a certified PCI Service Provider Level 1.
Vulnerability management
Academe works with external reviewers to conduct regular penetration testing of our infrastructure and applications. Automated scanners (Semgrep SAST, secret detection, dependency scanning, DAST) run regularly in CI to catch potential issues early.
DDoS protection
Academe employs multiple layers of protection against distributed denial-of-service attacks, including CDN-level mitigation via Vercel/Cloudflare, brute-force login prevention, customizable rate limits for API routes, and spend caps to prevent surprise bills from volumetric attacks.
Need security materials?
Team and Enterprise customers can request reports, questionnaires, and contracting documents for review.
Email hello@academe-ai.com