Trust and security
Pedagrade was built for instructional designers who work with confidential material. This page answers the questions a security, privacy, or accessibility review usually raises, in one place. It's written to be printed or saved as a PDF and passed along.
The short version
- Private AI. Course content is analyzed on hardware we own and operate. Pedagrade never sends it to any outside AI company.
- Inside ChatGPT or Claude. If you connect Pedagrade to an AI assistant, your conversation is handled by that assistant's provider under its own terms, as it would be anyway. Pedagrade's check still runs on its own private AI, and Pedagrade never forwards your content anywhere else.
- Never used for training. Your content is never used to train or improve any model.
- Minimal retention. Every review requires an account and is saved only to that user's own account, along with their course projects, and they can delete any of them themselves. A copy is kept for testing only if the user turns that on for a course.
- Encrypted in transit and at rest. Everything runs over HTTPS/TLS, and saved data is encrypted at rest.
- Stays in the United States. Course content is processed and stored in the US.
- No access to your environment. Pedagrade only sees the text a user chooses to paste, upload, or send it. No installers or local agents. Optional add-ins for Word and Google Docs read only the document they are open in, and only while they are open: each section you change, with checking while you design on, or the text you select when you run a check. They change your text only when you click to put in a fix. You can remove them anytime. Pedagrade has no access to your network, file shares, mailboxes, or LMS.
What Pedagrade is
A web application, which also works through connectors for Claude and ChatGPT and optional add-ins for Word and Google Docs, that reviews an e-learning course: it checks whether the objectives are measurable, maps each one to where it's taught, practiced, and assessed, and reviews the design against established learning-science frameworks and the accessibility content basics, which are tested (alt text, captions, color, link text, sensory instructions); other WCAG checks and usability are in beta. It gives cited recommendations and suggested fixes. Users paste course text or upload a file (Word, PowerPoint, PDF, Articulate XLIFF export, .imscc Canvas course export, or plain text).
How course content is handled
| What is sent | Only the course text a user pastes or uploads, to produce their review. Uploaded files are converted to text for the review; the original file isn't kept. |
| Where it's processed | On private AI hardware we own and operate. Never on a third-party AI service. |
| Training | Never used to train or improve any model. |
| Reviews | Every review requires an account and is saved to the user's own account so they can reopen it. Each user can only ever access their own reviews. |
| course projects | A course's objectives and each lesson a user checks against them, saved to that user's account so progress builds across the course. Same private AI, same access rules as reviews. |
| Deletion | Users can delete any saved review from History, and any course project (with everything checked in it) from Check while you design. Account deletion on request to support@pedagrade.com. |
| Sharing | Course content is never shared with other users, sold, or shared with third parties for their own use. |
Where data lives and how it's protected
| AI processing | On Pedagrade's own server in Ohio, United States. Course text is processed in memory to produce the review. |
| Saved reviews, course projects, and accounts | Supabase (Amazon Web Services, us-east-1, Virginia, United States), encrypted at rest. |
| "Is this right?" answers | Only which check it was (framework, rule number, severity), your yes or no, and an optional reason from a fixed list. Never the finding's wording or any course text. Stored with your account in Supabase and deleted with the review. |
| Review ratings | Whether the score seemed fair, whether the review was useful, and an accuracy rating, with the review's score, material type, and number of findings. No course text. Stored with your account in Supabase and deleted with the review. |
| Courses kept for testing (opt-in) | Only if you turn it on for a course: a copy of that course's text, used only on our own hardware to test Pedagrade's checks, never sent to an AI company or used for training. Deleted when you turn it off, delete the review, or delete your account. |
| In transit | HTTPS/TLS for every connection. |
| Who can see it | Each user can only access their own saved reviews and course projects, enforced by the database itself (row-level security). Administrative access is limited to the founder. |
| Logs | Course content is not written to the application's or the AI server's logs. |
How long we keep things
| Data | How long |
|---|---|
| Uploaded files | Converted to text for the review. The original file is never stored. |
| Reviews and lesson checks | Until you delete them (from History) or close your account. |
| Course projects | Until you delete them (from Check while you design) or close your account. |
| Account | Until you ask us to delete it. Deleted within 30 days of a request to support@pedagrade.com. |
| Billing records | Kept by Stripe for as long as tax and accounting law requires. |
| Newsletter sign-up | Until you unsubscribe. After that we keep only a note not to email you again. |
| Feedback and survey answers | Kept to improve Pedagrade. Ask and we'll delete yours. |
Student data and FERPA
Pedagrade is for course design material: design documents or storyboards, scripts, objectives, and assessments. It isn't built to hold student records, so please don't upload student names, grades, or other education records. Course materials generally aren't education records under FERPA. If student information is uploaded by mistake, email support@pedagrade.com and we'll delete it within 5 business days.
Contracts and questionnaires
- Data processing agreement. We'll review and sign your DPA, or provide ours on request.
- Security questionnaires, including HECVAT and custom vendor questionnaires. Completed within 5 business days.
- NDA on request, and a call to walk your team through how data is handled.
If something goes wrong
If we confirm a security incident that affects your data, we'll notify affected customers without undue delay and within 72 hours, with what happened, what data was involved, and what we're doing about it.
Report a security issue
If you think you've found a vulnerability in pedagrade.com, the app, or the add-ins, email support@pedagrade.com with "Security" in the subject and the steps to reproduce it. We'll reply within two business days and tell you when it's fixed. Please test only against your own account, don't access other people's data, and give us a reasonable chance to fix the issue before you share it. Our security.txt lists the same contact.
Accessibility
A tool that reviews courses for accessibility should meet the standard itself. We've reviewed pedagrade.com and the app against WCAG 2.1 AA with automated and keyboard testing, fixed what we found, and published our Accessibility Conformance Report (VPAT). Screen-reader testing is next. If you run into a barrier, email support@pedagrade.com and we'll fix it.
Accounts, payments, and cookies
- Accounts use email and password, with a self-serve password reset. SSO isn't required.
- Payments: if you buy the Individual plan, billing is processed by Stripe (PCI DSS Level 1). Card details are entered on Stripe's own checkout; Pedagrade never sees or stores card data.
- Cookies: a sign-in session cookie and, only for visitors who claim a bonus review, one that unlocks that single extra review. No advertising or cross-site tracking.
- Website analytics on pedagrade.com are cookie-free and aggregate only. They never run inside the app or on course content.
Service providers
Course content is processed only on our own hardware. These providers support the rest of the service. Last reviewed October 8, 2026.
| Provider | What it does | Where | Receives course content? |
|---|---|---|---|
| Supabase | Account sign-in and the database that stores signed-in users' saved reviews and course projects | United States (AWS us-east-1) | Saved reviews and course projects only, in the user's own account |
| Cloudflare | Secure network connection (TLS) to the app, and email routing | Global network | Encrypted traffic passes through; nothing stored |
| Stripe | Billing for subscriptions | United States | No |
| Discord | Private notifications to the founder: new sign-ups (email address), review activity (course title and score), and messages you send us (assistant questions, feedback) | United States | Course titles and scores, never course text |
| Google (Gmail) | The inbox for email you send to support@pedagrade.com and todd@pedagrade.com | United States | Only what you email us |
| Resend | Sending email, such as the opt-in newsletter | United States | No |
| Vercel | Hosts the pedagrade.com marketing website | Global network | No |
Network allow-list
If your web filter blocks Pedagrade, allow these hosts over HTTPS (port 443). No other ports or protocols are involved.
app.pedagrade.compedagrade.comesjyteldporgjqddqtmj.supabase.coThe supabase.co address handles sign-in and saved work. To buy the Individual plan, also allow checkout.stripe.com. The Word add-in also loads Microsoft's Office script from appsforoffice.microsoft.com.
pedagrade.com is a newer domain, which is the usual reason a filter flags it before its category is assigned. We're happy to help you request a recategorization.
What Pedagrade does not do
- No installers or local agents. Optional add-ins for Word and Google Docs read only the document they are open in, and only while they are open: each section you change, with checking while you design on, or the text you select when you run a check. They change your text only when you click to put in a fix. You can remove them anytime.
- Pedagrade has no access to your network, file shares, mailboxes, or LMS.
- No use of your content for AI training, by us or anyone else.
Certifications
Pedagrade is an independent, founder-run product and does not yet hold a SOC 2 or ISO 27001 certification. We'd rather say that plainly than imply otherwise. Everything on this page describes how the service actually works today, and we're glad to complete your questionnaire or walk your team through it on a call.
Questions, team pilots, and procurement: support@pedagrade.com.
Last updated October 12, 2026.