Security & COPPA Compliance
Zero-Trust Defense, Strict Child Protection, and Full Parental Transparency.
Child Safety
COPPA Ready
100% Ad-Free & Isolated
Data Transit
TLS 1.3 + HSTS
Encrypted End-to-End
Data at Rest
AES-256
KMS Key Rotation
Parental Control
4-Digit PIN
Lock Mode & Limits
1. Children's Online Privacy Protection Act (COPPA) Compliance
Pragati AI adheres to the strict standards set forth by the Children's Online Privacy Protection Act (15 U.S.C. 6501 et seq.) and international child safety standards:
Parents or authorized school educators provide verifiable permission prior to student account creation.
No tracking cookies, marketing pixels, or commercial behavioral profiling are ever installed on student pages.
Junior track students cannot send unmoderated private messages to unknown external internet users.
Parents maintain a custom 4-digit security PIN to restrict settings, approve upgrades, and monitor screen allowances.
2. AI Tutor Guardrails & Content Moderation
Our companion pets (Byte, Milo, Kumo, Rexi) and Advance Cyber Mentors are configured with robust, multi-layer semantic guardrails:
- Automated Content Filters: Every student query is screened in real-time. Inappropriate, toxic, or adult topics are instantly deflected into positive, encouraging coding guidance.
- PII Stripping & Protection: If a student accidentally inputs phone numbers, home addresses, or passwords into chat prompts, our frontend filters mask the sensitive values before transmission.
- Strict Non-Training Guarantee: No student questions, code snippets, or audio prompts are used to train external public LLMs.
3. Infrastructure Security & Sandbox Isolation
Vyomara Technologies enforces modern cloud architecture standards across all Pragati AI services:
- Ephemeral Code Sandboxing: Python and JavaScript code submitted by learners is executed in isolated, containerized sandboxes with strictly capped execution timeouts (5000ms), restricted memory bounds, and disabled raw networking sockets.
- Encrypted Communications: TLS 1.3 is enforced with forward secrecy across all endpoints. Plain HTTP requests are redirected automatically to HTTPS.
- Rate Limiting & Anti-Abuse: Upstash Redis distributed sliding-window rate limiters prevent API spamming and protect services against denial of service (DoS) attempts.
- Role-Based Access Control (RBAC): Engineering access to production systems requires hardware multi-factor authentication (MFA) and least-privilege role boundaries.
4. Responsible Vulnerability Disclosure Program (VDP)
We welcome collaboration with cybersecurity researchers and academic institutions to keep students safe:
- Submit vulnerability reports directly to security@pragatilearn.com.
- Do not access, alter, or delete student data or execute destructive denial-of-service tests.
- Include reproduction steps, proof-of-concept payloads, and risk assessment in your report.
5. Security & Safety Contacts
For inquiries regarding COPPA compliance, parental verification, or platform security audits: