Security

Boost minimizes what it stores and keeps business, individual, learner, and payment access separate.

Effective August 31, 2026

Controls

Business and individual purchaser access uses expiring email sign-in. Database row-level policies isolate accounts, and individual accounts are excluded from business dashboards. Learner URLs use high-entropy secrets whose SHA-256 digests are stored instead of the raw values. Browser sessions use HttpOnly, SameSite cookies. Payment activation requires an authenticated purchaser and a server-side transaction recorded in the audit log; business promotions additionally require an active organization administrator and an exact draft roster. Resend webhooks are signature-verified and idempotently recorded. Production configuration fails closed when required secrets are missing.

Data minimization

Boost never requests AI-provider OAuth, inbox access, chat history, or private work documents.

Reporting a vulnerability

Send a concise report through support with reproduction steps and impact. Do not access data that is not yours, disrupt service, or publicly disclose an issue before DAIA has had a reasonable opportunity to investigate.