Security at MasteryCue
Effective and last updated: October 11, 2026
MasteryCue uses layered safeguards designed for educator and student information. This page describes current controls without claiming that any system is immune from attack.
Access and identity
- Server-validated sessions and minimum password requirements.
- Organization, school, role, teacher, class, and student authorization boundaries.
- Clever-ready identity mapping plus SAML and OpenID Connect connection support.
- Server-only administrative and payment credentials.
Application and data
- Row-level database security and private upload storage.
- TLS in transit and encryption provided by managed infrastructure at rest.
- Webhook signature verification and replay protection for billing events.
- File size and type restrictions, structured validation, security headers, dependency scanning, and audit events.
- Privacy-preserving administrator reporting that suppresses cohorts below ten students.
Operations
We review access policies, dependencies, database security advisories, deployment results, and production errors. We maintain incident-response, recovery, retention, and deletion procedures and review critical service providers.
Verification and school review
On October 11, 2026, internal checks covered database access boundaries between synthetic teacher accounts, private upload storage policies, and dependency vulnerability scans. The database regression used synthetic records and rolled back its fixtures. Dependency scans reported zero known vulnerabilities in the scanned dependency trees at that time.
These checks are internal verification, not an independent penetration test or SOC 2 attestation. Ask for the scope and limitations of the current security review, incident-response process, recovery procedures, and applicable data-protection terms before a school rollout.
Review core service providers · Prepare your school review
Report a concern
Report a suspected vulnerability or security incident to MasteryCue support. Do not access, modify, or retain data that is not yours. Include the affected page, steps to reproduce, and potential impact without including student records in ordinary email.