Security

1. Hosting

The platform runs entirely on Amazon Web Services (AWS), in the US East (N. Virginia) Region. It is built from managed AWS services: AWS Lambda, AWS Step Functions, Amazon DynamoDB, Amazon S3, Amazon CloudFront, Amazon API Gateway, AWS Key Management Service (KMS), AWS Systems Manager Parameter Store, Amazon EventBridge Scheduler and Amazon Bedrock. It runs no servers of its own. Staging and production are separate AWS accounts.

The platform's web pages load no scripts, fonts or analytics from other companies. Outside AWS, it connects only to the institution's LMS.

2. Student lab accounts

Each lab runs in its own AWS account, used by one student at a time. Lab accounts belong to Clearbyte's AWS organization, in an organizational unit kept for labs; students never use their own AWS accounts or payment details. Each course is assigned its own set of lab accounts.

When a lab ends, Clearbyte:

1. records what is in the account and grades it;
2. deletes the resources the lab created;
3. deletes everything else of each kind of resource the platform manages, including what the student created;
4. audits the account.

The account is returned to the course's set for the next lab only if the audit finds nothing left. Otherwise it is held out of use with a report until an operator resolves it. A daily check also takes out of use any idle account that is still costing money.

While a lab runs, Clearbyte checks the account every minute against the lab's limits, such as the number of instances, and stops a student's use of AI models in the lab account after $1 per lab.

Lab accounts are reused. AWS CloudTrail keeps a 90-day history of the AWS actions taken in every account, and it cannot be deleted. Each entry includes the IP address and browser details the action came from, and names the lab user (for example, student-user), not the student. In labs that give students read access to the account, such as the AWS managed ReadOnlyAccess policy, a later student can read the history left by earlier students.

3. Permissions inside lab accounts

Each part of the platform that works in a lab account (for example, the part that manages Amazon S3) has its own IAM role there, limited to the permissions it declares and trusted only by that part. A role that asks for unrestricted access is refused.

4. Sign-in and credentials

• Students and instructors sign in through their LMS over LTI 1.3. Clearbyte has no passwords of its own. It accepts a sign-in only from an LMS, client and deployment it has registered, and checks each sign-in's signature, expiry and one-time values.
• Clearbyte signs its own LTI messages with a key held in AWS KMS. The private key never leaves KMS.
• A platform session is a 256-bit random token that expires after 12 hours. Clearbyte stores only a one-way hash of it. Sessions do not use cookies.
• A student's AWS console session lasts one hour and can reach only lab accounts.
• Passwords, access keys and key pairs created for a lab are stored encrypted in AWS Systems Manager Parameter Store and deleted when the lab ends.

5. Who can access data

• Instructors can see only their own course's students and results.
• The LMS Administrator role alone gives no access to courses' results.
• Clearbyte operators manage lab accounts across courses.
• Clearbyte's platform administrators can access all stored data, to run and support the platform.

What is stored, and for how long, is described in Student Data and Privacy.

6. Encryption

• In transit: TLS 1.2 or later on every platform address.
• At rest: Amazon DynamoDB, Amazon S3 and Systems Manager parameters use AWS-managed encryption. The S3 storage blocks public access. Files sent to the LMS are shared through links that expire after one day.

7. Logging, limits and backups

• Platform logs are kept for 30 days and do not contain student names, answers or tokens.
• Lab workflow history is kept for 90 days and contains IDs only.
• Each platform function has an alarm on errors.
• The platform API limits requests to 100 per second, with bursts up to 200.
• The databases have point-in-time recovery for the last 35 days.

8. Development

The platform's source code is kept in a private repository. Every proposed change is checked by automated tests before it is merged. The release pipeline (AWS CodePipeline and AWS CodeBuild) deploys to staging, runs live tests there, and needs approval before it deploys to production.

9. Certifications and questionnaires

Clearbyte has no SOC 2 report or other independent audit, and is not certified by 1EdTech, the standards body for LTI. Clearbyte will complete the HECVAT (the EDUCAUSE security questionnaire for higher education) for an institution on request.

10. Security incidents

If a security incident exposes an institution's student data, Clearbyte will notify the institution within 72 hours of confirming it.

Report a suspected vulnerability or incident to info@clearbyte.com.