Security & Data Handling
How TSI Hub authenticates users, protects data, and works with its service providers.
Authentication
TSI Hub uses Better Auth, an application-level authentication framework, to manage sign-in for every account. Two sign-in paths are supported:
- Email and password — passwords are never stored in plain text. They are one-way hashed (Argon2id) before being written to the database, so TSI staff cannot read a user’s password, and a database copy alone cannot be used to sign in as a user.
- Google OAuth — a user may instead sign in with an existing Google account. In this path, TSI Hub never sees or stores the user’s Google password; Google handles the authentication and only confirms the user’s identity back to TSI Hub.
Access within TSI Hub is role-based: a student, teacher, or admin account can only reach the data and actions appropriate to that role.
Data in Transit and at Rest
- All traffic between a user’s browser and TSI Hub is encrypted over HTTPS.
- Application data is stored in MongoDB Atlas, a managed database service, rather than on a self-managed server.
- Uploaded files are stored in DigitalOcean Spaces rather than on the application server itself.
- Our infrastructure and service providers are hosted in the United States.
Subprocessors
TSI Hub relies on a small, fixed set of service providers to operate. We do not add data-processing subprocessors beyond this list without updating this page:
| Service | Purpose | Data Involved |
|---|---|---|
| MongoDB Atlas | Primary application database | Account, class, and activity-log records |
| DigitalOcean Spaces | File storage | Uploaded files and resources |
| Resend | Transactional email delivery | Name and email address, message content |
| Google (OAuth) | Optional sign-in | Name and email address, at the user's choice |
Incident Response
If TSI becomes aware of an incident that may have affected the security of data held in TSI Hub, we will investigate promptly, take steps to contain and remediate it, and notify affected schools without unreasonable delay so they can meet their own notification obligations to students and parents. To report a suspected security issue, contact security@mytsi.org.
Further Documentation
A more detailed security questionnaire or SOC 2-style documentation packet can be made available on request for districts that require it as part of a formal procurement or vendor-review process — reach out to the contact above to request one.