1 Our Commitment
Shams AI is committed to protecting the personal and educational data of every user on the platform. We implement layered security controls — covering transport, storage, authentication, access control, and incident response — to ensure your data remains safe and private.
2 Data Encryption
In Transit
All communication between your device and our servers uses TLS 1.2 or higher. HTTP connections are automatically redirected to HTTPS.
🔒
HTTPS Enforced Everywhere
Every page and API endpoint on Shams AI runs exclusively over HTTPS. No data is ever transmitted in plain text.
At Rest
Student records, personal information, and sensitive platform data stored in our databases are encrypted at rest. This ensures that data remains protected even in the event of unauthorized physical or logical server access.
3 Authentication and Access Control
Password Security
- Minimum 8 characters required; 12+ strongly recommended
- Passwords are hashed using a strong, industry-standard algorithm — never stored in plain text
- Password strength is enforced at account creation and reset
Session Management
🛡️
Automatic Session Expiry
Sessions expire automatically — both after a period of inactivity and after a fixed maximum lifetime, whichever comes first. Users are required to sign in again to resume. Always log out on shared devices.
Two-Factor Authentication
Every account can turn on two-step sign-in from Settings → Account & Security. With it enabled, a correct password is not enough on its own: signing in also requires a six-digit code sent to the email address on the account, so a password that leaks or is guessed does not by itself grant access. Codes are single-use, expire after a few minutes, and lock out after repeated incorrect attempts. Turning the feature off requires both your current password and a fresh emailed code.
Role-Based Access
Access to data is strictly controlled by user role:
- Students — can only view their own records and progress
- Teachers — can only view students enrolled in their classes
- Parents — can only view their own child's records, once linked
- Organization Admins — can view organization-level data within their organization only
- System Admins — platform-level access; internal use only
4 Student Data Protection
FERPA
We respect the principles of the Family Educational Rights and Privacy Act (FERPA). Student educational records are accessible only to authorized educators, parents, and the students themselves.
COPPA
For users under 13, we comply with the Children's Online Privacy Protection Act (COPPA):
- Parental consent is required before collecting personal information from children under 13
- Data collection is limited to what is strictly necessary for the Service
- No marketing or advertising directed at children
- No sharing of child data with third parties without explicit consent
5 Infrastructure Security
Server and Hosting
- Application runs in a secure hosted environment with automated security patching
- Network traffic is monitored and access is firewall-controlled
- Production and staging environments are isolated from each other
Database Security
- Databases are access-controlled and not publicly accessible
- Regular automated backups are stored in isolated, encrypted storage
- Database queries use parameterized statements to prevent SQL injection
🔐
Backup and Recovery
Encrypted backups of all data are maintained separately from production. In the event of data loss, recovery procedures allow restoration with minimal disruption.
6 Application Security
- CSRF protection is enabled on all authenticated endpoints
- Content Security Policy (CSP) headers are enforced in production
- HSTS (HTTP Strict Transport Security) is enabled
- All user inputs are validated and sanitized to prevent injection attacks
- Third-party dependencies are regularly audited for known vulnerabilities
- Code is reviewed with security considerations as part of the development process
7 Vulnerability Reporting
If you discover a security vulnerability in Shams AI, please report it responsibly. We take all security reports seriously and commit to a prompt investigation.
- Email [email protected] with details of the issue
- Please do not publicly disclose the vulnerability until we have had a reasonable opportunity to address it
- We will acknowledge your report, keep you informed of progress, and credit responsible disclosures where appropriate
8 Incident Response
In the event of a suspected or confirmed security incident:
- We immediately investigate and work to contain unauthorized access
- We assess the scope, type, and sensitivity of any data affected
- Affected users are notified as required by applicable law (within 72 hours where mandated)
- Notifications include: what happened, what data was affected, and what steps you should take
- We implement remediation measures and review controls to prevent recurrence
9 Third-Party Services
We integrate with a limited set of third-party services (such as cloud hosting and email delivery). All vendors are required to maintain adequate security standards and are bound by data protection agreements. We do not share user data with third parties for advertising.
10 User Responsibilities
Security is a shared responsibility. We ask all users to:
- Use a strong, unique password for your Shams AI account
- Turn on two-factor authentication in Settings — especially for teacher and administrator accounts
- Never share your password with anyone, including teachers or admins
- Log out after each session, especially on shared or public devices
- Be cautious of phishing — Shams AI emails come only from @shamsai.app
- Report suspicious activity or unauthorized access immediately to [email protected]
11 Updates to This Policy
We continuously review and improve our security practices. This Security page may be updated as technology evolves and new threats emerge. Significant changes will be communicated to users via email or a platform notice.
12 Contact
For security concerns, questions, or to report a vulnerability: