Built like the compliance product it is.
If you are evaluating GAGE as a vendor, this page answers the assessment questions first. Everything below describes what is implemented today, in the same zero-fabrication standard we hold our curriculum to.
Data protection
Minimal personal data
We store what the product needs: name, email, profession, and learning progress. No payment data is collected anywhere on the platform today. We never sell personal data.
Database locked down
Learner data lives in PostgreSQL with row-level security enabled on every table, so the database's public API surface denies all anonymous and non-app access. The application reaches it only through authenticated server-side connections.
Authentication by Clerk
Sign-in and session management are handled by Clerk, a dedicated authentication provider. GAGE never sees or stores your password.
Encryption in transit
All traffic is served over HTTPS. Secrets are environment-scoped on the hosting platform, never committed to code.
Credential integrity
Signed, verifiable records
Every credential carries a server-side cryptographic signature (HMAC). Verification happens on our servers when anyone opens the credential link: a forged or altered record fails the check visibly.
Evidence, not assertions
A credential lists the mastery assessments actually passed, with scores. In-progress records are visibly labeled as in progress and can never be mistaken for completed ones.
AI safety and abuse controls
One guardrail, every surface
Every AI feature (the Socratic professor, credential Q&A, scenario grading) runs behind a single shared security guardrail with input fencing, so learner-supplied text is always treated as data, never as instructions.
Server-side integrity
Assessment grades are computed and clamped server-side. A manipulated client cannot award itself a pass.
Rate limits, flags, and kill switches
All AI endpoints are rate limited. Injection-shaped and flood behavior is flagged with founder alerts, and every AI surface has an administrative kill switch that can disable it instantly.
What we do not claim yet
We do not yet offer SAML single sign-on, SCORM/xAPI packages, or formal third-party certifications such as SOC 2, and we say so rather than imply otherwise. Data processing agreements and team procurement questions are handled directly: contact us and you will get answers from the people who built the platform.
Found a vulnerability? Report it through the support page and we will respond quickly. Good-faith security research is welcome.