Authentication
The current sign-in interface exposes email/password and Google through Firebase. Backend or schema support for another provider is not presented as proof of a current user-facing option.
Trust and security
Certifications are claimed only when supported by evidence.
This overview explains the boundaries established by the audited product and identifies the evidence an institution should request before adoption.
How key responsibilities are separated
Current boundariesPayment processing
Hosted Stripe Checkout and the Stripe-hosted billing portal collect payment details on Stripe surfaces. Stripe Price data and runtime configuration, rather than marketing fallback values, determine the charged amount.
Local and cloud data
Guest persistence differs by lab. Cloud records for signed-in users, course progress, sharing, and Classroom data follow separate authenticated services and entitlement rules.
Access and disclosure
Public, unlisted, and revocable links have different boundaries. Unlisted content is not private merely because it is absent from a public index.
Operational evidence
Evidence an institution should request
An institutional review should ask for the current system boundary, authentication flow, encryption in transit, backup and monitoring posture, incident contact, subprocessors, retention and deletion behavior, and the release stage of any protected product being purchased.
- Confirm which data remains in the browser and which is stored in cloud services.
- Confirm who can access shared, course, and Classroom records.
- Confirm payment, tax, refund, invoice, and entitlement fulfillment paths.
- Confirm how incidents and security reports are received and escalated.
Institutional evidence pack
Procurement should receive documents, not broad enterprise language
Before organization sales are positioned as institution-ready, DigiSim should provide a legal-entity record, invoicing path, data-flow diagram, current subprocessor list, retention and deletion process, security contact, accessibility status, and the exact Classroom release stage.
- Provide a DPA or education-data addendum only when a reviewed document exists.
- State support response commitments only when the operating team owns them.
- Do not imply SSO, SCIM, data residency, certification, or an SLA without an implemented and evidenced service.
Contact
Use a non-public route for sensitive reports
Send the smallest necessary reproduction through the support contact route. Do not transmit credentials or access tokens, and do not place student data, confidential circuits, or unpublished vulnerability details in a public circuit, Gallery item, or public issue.
Running an institutional review?
Use the current documents to distinguish available evidence from missing records, and include the remaining requirements in your inquiry.