Loading...
Loading...
Security and data handling
This page describes the controls currently present in the application. AdmitPath does not claim its own SOC 2 certification, school-district SSO, MFA, FERPA certification, or an independently audited security program.
AdmitPath uses Google OAuth. After Google returns a verified account identifier and email, AdmitPath creates an HTTP-only, Secure, SameSite=Lax signed session cookie with a 30-day expiration. Production signing requires a dedicated secret of at least 32 characters.
Profile details, essays, analyses, college lists, and application tracking records are scoped to the authenticated user in Postgres. Account export and confirmed account deletion are available from Settings. Deleted records are filtered from normal authenticated reads.
State-changing API requests are checked for cross-site browser requests. Responses use a restrictive framing policy, MIME-sniffing protection, HSTS, a Content Security Policy, and no-store caching for APIs. Cost-bearing routes use per-account and per-IP throttles; distributed enforcement requires the configured Redis service.
Subscription checkout and plan management are hosted by Stripe. AdmitPath stores Stripe customer and subscription identifiers, not card numbers. Webhook signatures are verified before subscription state is changed, and unknown prices do not grant paid access.
Text submitted for AI features is sent to the configured model provider to produce the requested result. Optional product email requires consent, and signed one-click unsubscribe links turn that consent off. See the Privacy Policy for the current provider and retention disclosures.
Please do not include passwords, session cookies, API keys, or sensitive student records in the first message.
Email the security contact