Provenance
What FacultaStudio does to keep its data safe and its pages usable by everyone, the standards it measures itself against, and when each claim was last checked.
Last verified 23 September 2026. Self-assessed; not a third-party audit or a certification.
No student records. FacultaStudio reads job advertisements. It does not collect, receive or store records about individual students, so FERPA’s rules on education records have nothing here to apply to, and that is by design. The privacy policy says exactly what it does hold.
Security controls
- Row-level security on every table reachable through the data API, with the public able to read only the published aggregates.
- No privileged key in the web application. The key that bypasses the database rules is never shipped to a browser, and the build refuses to proceed if one appears under the application code.
- Transport and browser protections: HTTPS only with HSTS preload, a Content-Security-Policy, framing denied, MIME sniffing disabled, a strict referrer policy.
- Encryption in transit (TLS) and at rest by the database host, Supabase.
- Privacy by default: optional analytics only after you opt in; the anonymous page counts described in the privacy policy hold nothing that identifies you.
Accessibility
We aim for the Web Content Accessibility Guidelines (WCAG) 2.2 at level AA, which includes the WCAG 2.1 AA required by the U.S. Department of Justice’s 2024 ADA Title II rule and the WCAG 2.0 AA incorporated by Section 508. Automated scans find only part of what WCAG covers; the gaps below say what has not been tested by people yet.
Standards we measure against
- WCAG 2.2 level AA, for accessibility.
- The OWASP Top 10 (2021), as a checklist: broken access control (A01), security misconfiguration (A05) and vulnerable components (A06) are covered by the log below.
- FERPA (20 U.S.C. § 1232g; 34 CFR Part 99), which this project is built to stay outside of.
Verification log
| Date | Check | Scope | Result |
|---|---|---|---|
| 2026-09-23 | Automated accessibility scan of the live site, after deploy | 4 public pages at desktop width; the overview at phone width | No violations on any scanned page. |
| 2026-09-23 | Leaked-password protection | Sign-in for every account | Switched on. New and changed passwords are checked against the Have I Been Pwned list of breached passwords, and known ones are refused. |
| 2026-09-23 | Database access rules | Every table and view reachable through the data API | Anonymous visitors reach only the published schema of aggregate figures. Signed-in coders and programme members read only their own rows; the reference tables they share hold no personal data. No rule lets one account read or change another's. |
| 2026-09-23 | API route review | Every API route | No route holds the privileged database key; the build fails if one appears. The analytics route accepts inserts only, tagged to this site, and can read nothing. |
| 2026-09-23 | Dependency vulnerability audit (npm audit, production dependencies) | All production dependencies | 0 known vulnerabilities. Next.js 16.3.4. |
| 2026-09-23 | Security headers, as served | facultastudio.com | HSTS with preload, Content-Security-Policy, framing denied, MIME sniffing disabled, strict referrer policy, camera, microphone and location disabled. |
| 2026-09-23 | Automated accessibility scan (axe-core, WCAG 2.0/2.1/2.2 A and AA rules) | 7 public pages, light and dark mode, desktop; the overview at phone width | Before: text-contrast failures on every page, 218 on the research page alone. After: no violations on any scanned page in either colour scheme. |
What we have not done yet
- Inline scripts. The Content-Security-Policy still allows inline scripts, which weakens its protection against injected code. A per-request nonce would close it.
- People-tested accessibility. No keyboard-only or screen-reader walk-through has been done, and the signed-in coding tools have not been scanned.
- Independent review. Everything here is self-assessed.
Reporting a problem
Email privacy@facultastudio.com about any security issue or accessibility barrier. Please do not test against other people’s accounts or data.