Infrastructure
Sightline is hosted on established cloud providers in the United States. The database is Supabase managed Postgres. The application runs on Railway. Traffic is encrypted in transit with TLS/HTTPS.
SOC 2 Type 1, coming
We take the security of institutional and student data seriously.
This page covers the Sightline application colleges use for financial planning. It is a plain account of the controls in place, and of the work still underway.
A SOC 2 Type 1 audit is coming, scoped to the Security Trust Services Criteria.
How the service is protected.
Hosting, access, development, monitoring, and the security program, as they stand.
Data isolation and access control
Each institution's data is logically isolated. Every API request is checked against the user's organization membership and role. Database tables are locked behind row-level security, so only the server can reach them. Within an institution, access is role-based.
Account security
Multi-factor authentication is required on all of our administrative and infrastructure accounts. Production access is limited to a minimal set of named personnel, under least privilege.
Secure development
Every change moves through dev, then preprod, then production. Automated checks run on that path: lint, typecheck, and tests. Dependencies are scanned for known vulnerabilities. Secrets are kept out of source code, stored in managed environment storage, and rotated. We run periodic internal security reviews, and remediation is tracked.
Monitoring and resilience
The application has error monitoring and alerting. Database backups are automated and include point-in-time recovery. Restores have been tested.
Privacy and student data
We support institutions' FERPA obligations. Customer data is used only to provide the service. It is never sold, and it is never used to train AI models. A Data Processing Agreement is available on request.
Security program
Written security policies are being formalized as part of the SOC 2 program. They cover information security, access control, incident response, vendor management, and more. Vendors are reviewed.
Questions reviewers ask.
- Are you SOC 2 certified?
- A SOC 2 Type 1 audit is coming, scoped to the Security Trust Services Criteria.
- Where is data hosted?
- In the United States. The database is Supabase managed Postgres, and the application is hosted on Railway. Connections are encrypted in transit with TLS/HTTPS.
- Can we get a DPA?
- Yes. A Data Processing Agreement is available on request. Email tom@sightline.college.
- Is customer data used to train AI models?
- No. Customer data is used only to provide the service. It is never sold, and it is never used to train AI models.
- Who can access production?
- Multi-factor authentication is required on all of our administrative and infrastructure accounts. Production access is limited to a minimal set of named personnel under least privilege.
You may request a security questionnaire.
Documentation and a Data Processing Agreement. tom@sightline.college