Security at Rise Bright

Rise Bright takes the security and privacy of your family's data seriously. As an educational platform serving children with diverse learning needs, we hold ourselves to the highest standards of data protection.

TLS encryption AES-256 data encryption AI privacy safeguards Built following OWASP guidelines 3,900+ automated tests Encrypted off-site backups Container hardening MFA for admin accounts

Data protection

Encryption

All data transmitted to and from Rise Bright is encrypted using TLS 1.2 or 1.3. Sensitive data stored in our database is encrypted using AES-256-GCM, a military-grade encryption algorithm.

Our backup script encrypts database backups with GPG (AES-256), and only encrypted copies are sent to our off-site storage (Google Drive).

AI privacy

When we send learning requests to our AI provider, we leave your child's name out or replace it with a placeholder. We send their year level, state, learning needs, interests and assessment results so the AI can adapt. If you turn on Roo, your child's messages are sent as typed, for Roo's answers, our safety check and the session summaries Roo writes for you. See section 4 of our privacy policy.

Where a learning request or one of Roo's answers would include your child's name, we replace it with a random placeholder (for example "Student-a7f3"). Our safety check and Roo's session summaries can include your child's first name
The map of placeholders exists only for a single request and is never stored

Application security

Testing & monitoring

Our automated test suite runs more than 3,900 tests on every code change, including a dedicated security suite covering authentication, authorisation, rate limiting, injection prevention, CSRF protection, and more.

We regularly scan our dependencies for known vulnerabilities and generate a Software Bill of Materials (SBOM) for full supply chain transparency.

Infrastructure

Docker containers with hardened security profiles (read-only filesystems, dropped capabilities)
Cloud firewall restricting access to only necessary ports
Edge and application-layer request filtering: geo-fencing, bad-bot and malicious-path blocking, per-IP rate limiting, input sanitisation, and SQL-injection and XSS defence (OWASP-aligned)
Prompt injection protection on all AI-powered endpoints
Role-based access control with MFA for administrative access
Comprehensive audit logging of all administrative actions

Standards we follow

Rise Bright is built following:

Australian Privacy Act 1988, Australian Privacy Principles (APPs), as our privacy policy describes
OWASP Application Security Verification Standard, Level 1, checked by our own self-assessment
OWASP Top 10 guidelines on the most common web application security risks

For schools and institutions, we provide a Data Processing Agreement (DPA) and Service Level Agreement (SLA) upon request.

Responsible disclosure

If you discover a security vulnerability in Rise Bright, please report it responsibly to security@risebright.com.au. We commit to:

Acknowledging your report within 48 hours
Providing a timeline for remediation
Keeping you informed of progress
Not taking legal action against good-faith security researchers

Questions?

If you have questions about our security practices or need documentation for your school or institution, please contact us at security@risebright.com.au.

Last updated: October 2026