Solus is designed from the ground up for educational use. Student data is protected under the Family Educational Rights and Privacy Act (FERPA), and we offer a Data Processing Addendum (DPA) for institutional customers.
Last reviewed: June 2026 · Questions: soluseditor@gmail.com
X Point does not sell, rent, or monetize student educational records in any form. Student submission data is used solely to provide the Solus service to your institution.
Essay content is encrypted with a per-document AES-256 key on the student's device. X Point servers store only encrypted ciphertext. We cannot read student writing.
We collect the minimum data required to operate: account email, keystroke timing metadata (not content), and encrypted submission files. We do not collect names, dates of birth, or demographic data.
Institutions retain ownership of student records. Data can be exported or deleted at any time on request. We support data subject access requests within 30 days.
| Data type | What it contains | Where it's stored | Who can access |
|---|---|---|---|
| Account record | Email address, hashed password, institution name, role | Supabase (US-East-1, SOC 2 Type II) | Student, institution admin |
| Keystroke metadata | Timing of keystrokes, total count, session duration. No characters typed. | Encrypted inside .solus file (local + submitted copy) | Student, assigned teacher |
| Essay content | Document text, encrypted with per-document AES-256 key | Encrypted inside .solus file (local + submitted copy) | Student only (teacher sees plaintext only via the Solus app after student submits) |
| Submission record | Submission timestamp, assignment ID, verification status, teacher grade | Supabase (encrypted at rest) | Student, assigned teacher, institution admin |
| Paste quarantine log | Text pasted into the editor (stored per submission for provenance) | Encrypted inside .solus file | Student, assigned teacher |
The following third-party services process student data on our behalf. All sub-processors are contractually bound to process data only as directed by X Point.
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| Supabase | Database, authentication, file storage | Account records, encrypted submission files, grades | US-East-1 (AWS) |
| Resend (optional) | Transactional email (grade return notifications) | Student email address, document title only | US |
| Netlify | Static website hosting | No student data — website only | US |
A Data Processing Addendum is required by most US school district procurement processes. We provide a signed DPA to all institutional customers at no cost. The DPA formalizes X Point's obligations as a data processor under FERPA.
Yes. X Point operates as a school official under FERPA when providing services to institutions, and we are subject to the same limitations as school officials regarding use of student records. We use student data only for the legitimate educational purpose of operating the Solus service.
Yes. Under FERPA, students have the right to inspect their own educational records. Students can view all their submissions within the Solus app. For a complete data export, contact soluseditor@gmail.com.
For students under 18, parents have the right to access educational records under FERPA. Institutions should route parent access requests through their standard FERPA process. X Point will comply with verified institutional requests for student data access.
Solus requires all users to be 13 or older. We do not knowingly collect data from children under 13. If you believe a child under 13 has created an account, contact us immediately at soluseditor@gmail.com for immediate deletion.
No. Solus does not use student submission content to train any machine learning models. The provenance verification system uses cryptographic methods only — no AI analysis of content occurs on X Point's infrastructure.
You'll receive 60 days advance notice before any data deletion. During that window you can export all data via CSV. After the retention period, all student records are securely deleted and we'll provide a deletion confirmation certificate.
Questions about compliance? Email soluseditor@gmail.com. We typically respond within 1 business day.
Related: Privacy Policy · Terms of Service · School Licensing