Skip to policy content

Security & Compliance

Security, privacy, and compliance controls for Academe research workspaces.

Customer data is not used for model training

Research content is sent only when needed to provide the feature being used.

Encryption in transit and at rest

Traffic uses TLS and stored customer data is encrypted by the underlying services.

Role-scoped access

Organization access is scoped by role, with separate paths for collaborators and billing admins.

Review materials available

Team and Enterprise customers can request reports, questionnaires, and contracting documents.

Contents
  1. Overview
  2. Multi-factor authentication
  3. SOC 2 Type II
  4. HIPAA
  5. Data encryption
  6. Role-based access control
  7. Backups
  8. Payment processing
  9. Vulnerability management
  10. DDoS protection
01

Overview

Academe is built for research materials that may be private, unpublished, or institutionally sensitive. We treat security as part of the product surface, with documentation and controls that can be reviewed during procurement or security review.

02

Multi-factor authentication

Users can enable multi-factor authentication (MFA) on their Academe account for an additional layer of security beyond passwords. MFA adds a second verification step during sign-in and reduces the risk of unauthorized access if a password is compromised.

03

SOC 2 Type II

Academe maintains SOC 2 Type II controls for security, availability, and confidentiality. Team and Enterprise customers can review the current report under NDA.

Enterprise and Team customers can request the report by emailing hello@academe-ai.com.

04

HIPAA

Academe supports HIPAA-regulated research workflows under a Business Associate Agreement (BAA). Protected Health Information (PHI) should only be stored on Academe after the BAA is in place.

Enterprise customers can request to sign a BAA by emailing hello@academe-ai.com.

05

Data encryption

All customer data is encrypted at rest using AES-256 and in transit via TLS. Sensitive material such as access tokens and user-provided API keys (BYOK) is additionally encrypted at the application layer and stored via Supabase Vault.

06

Role-based access control

Organization members can be granted fine-grained access to specific resources within Academe. Roles include read-only access for collaborators who only need to view data, and billing-only roles for administrators who manage subscriptions without accessing research content.

07

Backups

Paid customer databases are backed up daily. Point-in-time recovery supports restoration within the available recovery window if accidental deletion or unexpected infrastructure issues occur.

08

Payment processing

Academe uses Stripe to process payments and does not store personal credit card information on its servers. Stripe is a certified PCI Service Provider Level 1.

09

Vulnerability management

Academe works with external reviewers to conduct regular penetration testing of our infrastructure and applications. Automated scanners (Semgrep SAST, secret detection, dependency scanning, DAST) run regularly in CI to catch potential issues early.

10

DDoS protection

Academe employs multiple layers of protection against distributed denial-of-service attacks, including CDN-level mitigation via Vercel/Cloudflare, brute-force login prevention, customizable rate limits for API routes, and spend caps to prevent surprise bills from volumetric attacks.

Need security materials?

Team and Enterprise customers can request reports, questionnaires, and contracting documents for review.

Email hello@academe-ai.com