Hosting
The app runs on Google Firebase and Google Cloud (Cloud Functions, Firestore, Firebase Hosting) in the United States (us-central1).
Security overview
How Vistara protects student data.
This page describes the security controls that are in place today. It is written for international student offices, IT security reviewers, and students. It does not claim certifications Vistara does not hold.
Status · Controls in place, no third-party certification yet
Infrastructure
Encryption
All traffic uses HTTPS with HTTP Strict Transport Security. Google Cloud encrypts stored data at rest by default.
No direct database access
Firestore security rules deny all reads and writes from browsers. Every data request goes through the Vistara server, which checks who is asking.
Secrets
AI provider and email keys are kept in Google Secret Manager and are never sent to the browser.
Access controls
Sign-in
Firebase Authentication with Google sign-in or a verified email address. Features that read personal records require a verified email.
App verification
Firebase App Check with reCAPTCHA Enterprise blocks automated clients from sensitive endpoints.
Verified DSO access
Advisor tools stay locked until the requester's institutional email and official office page are checked. Uncertain requests go to human review, and an administrator cannot approve their own request.
Rate limits and logging
Each sensitive action has hourly limits, and AI features also have daily limits. Security events and school-guidance changes are logged with hashed account identifiers and a set retention date.
Data handling
| Topic | Practice |
|---|---|
| School records | Vistara works without any school or SEVIS records. A school shares FERPA-covered records only after a signed data agreement (see below). |
| AI providers | Resume, job, and question text is sent to Anthropic, OpenAI, or Google Gemini only to produce the output the user asked for. Student documents are not used to train models by default. |
| Account deletion | Users can permanently delete their account and personal records from Profile → Delete account. Deletion can also be requested at contact@vistarapath.com. |
| Ask history | Raw Ask Vistara history stays in the user's own browser for 30 days. |
| Data location | United States. |
For schools
FERPA. Before Vistara processes education records for a school, the school and Vistara sign a data agreement that designates Vistara as a school official with a legitimate educational interest (34 CFR 99.31(a)(1)(i)(B)), keeps the school in direct control of the records, limits use to the school's stated purposes, and sets security, retention, deletion, and no-redisclosure terms. Vistara will sign the school's own agreement or provide a template.
Security questionnaires. Vistara completes the EDUCAUSE Higher Education Community Vendor Assessment Toolkit (HECVAT Lite) on request. Vistara does not currently hold a SOC 2 report.
Report a security issue. Email contact@vistarapath.com. We acknowledge reports within 2 business days.