How we protect the Service today
This is an operational summary, not a SOC 2 report. Counsel should also read the DPA, Privacy Policy, and counsel appendix.
Product security
- Permissions follow the school’s invites and roles
- Business hosts cannot open full student profiles, resumes, date of birth, or guardian data by default
- Student opt-in before business hosts see resume or phone
- Publish-time AI review flags unsafe or unpaid-labor framing in program copy; staff still decide what to publish
Infrastructure
- Primary hosting, auth, database, and file storage: Google Cloud / Firebase, United States
- Google Cloud encrypts customer data at rest in its commercial cloud
- TLS for traffic outside the platform
- Transactional email via Resend under a subprocessor contract
Incidents
When we confirm unauthorized access to, disclosure of, or loss of Student Data, we notify the school without undue delay and, where feasible, within 72 hours of confirmation. Schools remain responsible for parent and regulator notices.
Report a concern
Security or privacy questions: privacy@internpick.com. We do not run a public bug-bounty program today.
