PediaSphere
Security & Trust

Your data, treated like critical infrastructure.

Membership rolls, dues history, registrations, abstracts — this is the operational heart of your organization. PediaSphere is built on Microsoft Azure with encryption everywhere, passwordless access, role-based permissions, automated backups, a full audit trail — and AI that is scoped, filtered, and never trained on your data. Here's how it works.

Defense in Depth

Five layers between the internet and your data.

No single control is asked to do all the work. Each layer assumes the one outside it could fail.

1
Network — Microsoft Azure
Hosted in Microsoft Azure data centers with DDoS protection, network isolation, and Microsoft's physical and environmental security.
2
Transport — TLS everywhere
All traffic between your browser and PediaSphere is encrypted with TLS. Certificates are monitored and renewed automatically; plain HTTP is never served.
3
Identity — passwordless access
No passwords to steal, reuse, or phish. Access is granted through one-time email links, SMS codes, or authenticator-app (TOTP) codes that expire.
4
Application — role-based permissions
Every request is checked against the user's role. Staff, committee members, and members each see only what they're entitled to.
5
Data — encrypted at rest
Databases and backups are encrypted at rest in Azure SQL. Your organization's data is logically isolated from every other customer.
How It Works

The controls, illustrated.

Encrypted in transit

From the moment a page loads to the moment a report downloads, the connection is encrypted. Nothing travels the public internet in the clear.

  • TLS on every subdomain, enforced — HTTP redirects to HTTPS
  • Certificates renewed automatically before expiry
  • Modern cipher suites only; legacy protocols disabled

Encrypted at rest

Data doesn't just need protecting while it moves. Databases, backups, and file storage are encrypted on disk, so even physical access to storage media yields nothing readable.

  • Azure SQL transparent data encryption, always on
  • Backups encrypted with the same keys as the live database
  • Keys managed and rotated by the Azure platform

Passwordless sign-in

Most breaches start with a stolen or reused password. PediaSphere removes the password entirely: a one-time code or link is delivered to a channel you already control, and it expires in minutes and works only once.

  • Verified email link, SMS code, or authenticator app (TOTP) — your choice
  • Nothing to remember, nothing to phish, nothing in a password dump
  • Short-lived, single-use tokens; sessions expire automatically and every sign-in is logged

Role-based, row-level permissions

A society has staff, officers, committee chairs, reviewers, and members — and they should not all see the same thing. Permissions are enforced on every query, not just hidden in the interface.

  • Roles map to real organizational responsibilities
  • Row-level filtering: a committee chair sees only their committee's data
  • Administrators grant and revoke access without contacting us

Automated backups & point-in-time restore

Mistakes happen — a bulk import goes wrong, a record is deleted. Azure SQL keeps continuous backups so we can restore your database to any point in the retention window, not just last night.

  • Continuous backups with point-in-time restore
  • Geo-redundant copies stored in a second Azure region
  • Restores are tested; recovery isn't theoretical

Audit trail on everything

Who signed in, from where, and what they changed — every significant action is recorded with a timestamp and the acting user. When a board member asks "who edited this?", you have the answer.

  • Sign-ins, role changes, exports, and record edits are logged
  • Logs are append-only; they can't be altered by application users
  • Available to your administrators on request
AI Security & Guardrails

AI that answers questions — without oversharing.

AI is central to how PediaSphere works, so it gets its own set of controls. The principle is simple: the AI sees only what it needs to answer the question in front of it, for the person asking it, and nothing it sees leaves your organization's boundary.

Every request passes through the same gates

Before the AI sees anything, the request is scoped and filtered. After it answers, the exchange is logged and sampled for human review. The model itself is never trained on your data.

  • Scoped to you. The AI can only reach your organization's data, filtered by the asking user's own role and row-level permissions — the same rules that govern the rest of the platform.
  • Sensitive fields are filtered out. Government IDs, dates of birth, and payment details are never placed in an AI prompt. Demographic and DEI fields — race, ethnicity, gender identity, disability, health, religion — are excluded at the individual level and only ever reach the AI as aggregate counts, and only for users whose role permits demographic reporting.
  • No model training on customer data. Your data, questions, and answers are not used to train or fine-tune any model. Our AI providers are contractually bound to the same: no retention beyond the request, no training.
  • Every exchange is logged. AI questions and answers are recorded in the audit trail with the acting user, and a sample is reviewed by our team to catch errors, drift, and anything that should have been filtered.
Prompt-injection defenses
Content from records, uploads, and emails is treated as data, never as instructions. The AI cannot be talked into changing roles, revealing other users' data, or taking actions it wasn't asked to.
Read-only by default
The AI answers questions; it does not edit records, send email, or change settings. Any action is a separate, explicit, logged operation performed by a human.
Aggregates, not individuals
Demographic and DEI questions are answered as counts and percentages with a minimum group size, so no answer can be traced back to a single member.
Grounded answers
Answers are built from your data and our documentation, and cite where they came from. When the AI doesn't know, it says so and escalates rather than guessing.
Providers under contract
AI model providers are engaged under enterprise terms: zero data retention, no training on inputs or outputs, and encryption in transit to and from the model.
Your data stays yours
Nothing learned from one organization is ever used to answer another's questions. Tenants are isolated at the AI layer exactly as they are in the database.
Operational Practices

Security is a habit, not a feature.

Beyond the platform controls, these are the day-to-day practices we hold ourselves to.

Patched continuously
Azure applies OS and platform patches automatically; application dependencies are reviewed on a regular cadence.
Least privilege
Production access is limited to the engineers who need it, with separate credentials for every environment.
Secure development
Parameterized queries, input validation, and output encoding on every page — the basics, done every time.
Monitored 24/7
Uptime, error rates, and unusual access patterns are monitored around the clock with automated alerting.
Data residency
Your data is hosted in a designated Azure region and is not moved without your agreement.
Incident response
If something affects your data, you hear it from us first — with what happened, what we did, and what changes.
Working With Your Team

Procurement asked for a questionnaire? Send it over.

Security questionnaires & DPAs

We complete vendor security questionnaires and sign Data Processing Agreements as part of onboarding. Our standard Data Processing Agreement is published and ready to sign. Send yours to security@pediasphere.ai and we'll return it promptly.

Responsible disclosure

Found a vulnerability? We want to know. Email security@pediasphere.ai with details. We acknowledge every report, fix confirmed issues, and credit researchers who ask to be credited.

Questions about how we'd handle your data?

We're happy to walk your IT lead or board through any of this.

Talk to Us