Security

How UPC AI protects student data.

Your account

Passwords are hashed with bcrypt (never stored in readable form). Sign-in codes are single-use, expire in 10 minutes, and are stored hashed. Sessions use short-lived signed tokens with rotating refresh credentials — if a refresh token is ever replayed, the session is revoked automatically.

Your conversations

Chats are tied to your account and are never used to train AI models. You can delete your account at any time — your profile is anonymised and your sessions are revoked everywhere.

College documents

Documents live in access-controlled storage. Every document carries an access level: public documents power answers for everyone; internal and restricted documents are invisible to students at the database-query level — not just hidden in the interface.

API keys & infrastructure

AI provider keys live only in server-side encrypted environment variables — never in the browser, never in the database, never in the admin panel. The site enforces strict security headers, including HSTS and a Content Security Policy.

Abuse protection

Login lockouts, hashed one-time codes, per-account and per-IP rate limits, and daily usage quotas protect the service and your account from brute-force attacks.

Questions?

Write to hello@upcai.app and we will answer — usually within a day.

Last updated: September 2026 · UPC AI, Udai Pratap College, Varanasi