Security

Vidya is operated by A3 Partners Pte Ltd, Singapore. This page answers common security and privacy questions about Vidya. It describes controls currently enabled in the product. It is not an independent certification.

Prefer to check for yourself? Run the live security verification — it tests the headers, HTTPS enforcement, violation reporting and audit-log availability on this very response.

Access and authentication

• Email/password and Google sign-in via a broker that supports iframe-safe flows.
• Sessions are held in secure browser storage; you can sign out from any device.
• Admin actions are gated by a server-side role check, not by client-side flags.

Data at rest and in transit

• All traffic uses HTTPS/TLS, with HSTS enforced for a year.
• Application data is stored in a managed Postgres database with encryption at rest.
• Row-level security policies scope every user-owned table to the signed-in user.

Browser hardening

• A Content Security Policy restricts where scripts, styles, and frames can load from.
• The app can only be framed by us, so it cannot be wrapped by a lookalike site.
• Sensitive browser capabilities (camera, microphone, location) are denied by default.

Abuse and spend limits

Every AI feature is metered per account against durable, server-side budgets — per minute and per day — so a compromised or automated client cannot run up usage or degrade service for other learners. Limits are enforced in the database, not in your browser.

Accountability

Sensitive administrative actions — changing a plan, granting or removing a role, issuing or revoking a partner key — are written to an append-only audit trail with the actor, the target, and the before and after values. Those entries cannot be edited or deleted from the application by anyone, including us.

Partner integrations

Partners never receive direct database access. They call scoped HTTP endpoints with a key that is stored only as a hash, carries an explicit permission scope, is rate limited, and can be revoked instantly. Every request must be signed and timestamped, so a captured request cannot be replayed.

Payments

Card details are handled entirely by our PCI-DSS compliant payment processor. Vidya never sees or stores your card number.

Subprocessors

• Hosting and database — managed cloud infrastructure.
• Authentication — managed identity provider.
• Payments — Stripe.
• Transactional email — Resend.
• AI features — Anthropic, OpenAI, Groq, Perplexity, FAL, and ElevenLabs.
• Product analytics — PostHog.
• Embedded lesson video — YouTube.

What we do not do

• We do not sell your data.
• We do not run third-party advertising trackers in the product.
• We do not train shared AI models on your private answers.

Report a vulnerability

Please email security@atriverse.com with a description and steps to reproduce, or read our security.txt. We aim to acknowledge within 2 business days and will keep you updated as we investigate. Please do not access, modify, or delete data belonging to other users while testing.

India Grievance Officer

Gaurav Atri, for Atri Gurukul Private Limited (India), at grievance@atriverse.com. We acknowledge complaints within 24 hours and resolve them within 15 days.