Security and privacy at StageReader
StageReader handles graduates' names, RSVPs and short audio clips on behalf of colleges and universities. This page summarizes how that information is protected, in the terms your IT and privacy teams will ask about.
What we collect, and why
Only what the ceremony needs. Your institution supplies the graduate list; StageReader stores name, student number, program, and the contact email used for invitations. Graduates add an RSVP, guest names, optional accessibility requests, and, where your institution asks for it, a photo and video acknowledgement. The pronunciation audio is a few seconds of the graduate's name. There is no tracking, advertising, or sale of data, and the institution remains the custodian of its students' information.
Encryption
In transit
All pages, logins and the desktop-app sync run over HTTPS (TLS). Plain HTTP is redirected and browsers are told to remember the HTTPS-only rule.
Audio at rest
Every name recording is encrypted with AES-256-GCM before it touches disk. The key lives outside the web root and is never stored beside the audio.
Database at rest
The database files are encrypted at rest (transparent data encryption). Passwords and student PINs are stored only as bcrypt hashes.
Secrets
API keys, signing keys and database credentials are kept outside the web root on the server and outside version control.
Access control
- Institution-scoped roles. Administrators and presenters see only their own institution and ceremonies. Students see only their own record, unlocked with an institution code, student number and a one-time PIN.
- Single sign-on. Staff can sign in through your identity provider using SAML 2.0 (Microsoft Entra ID tested). Accounts are matched per institution.
- Hardened sessions. HTTP-only, secure, same-site cookies; strict session mode; CSRF tokens on every form; rate limiting on every login endpoint.
- Assisted registration is attributable. When a staff member completes a registration on a student's behalf, every action is tagged with the staff member's identity in the audit log.
Audit logging
Logins and logouts, imports and exports, record edits, PIN resets, audio generation and approval, desktop-app synchronisation and API activity are written to an append-only audit log with timestamp, actor, IP address and detail. Institution administrators can review their own institution's log at any time.
Hosting and data residency
- StageReader runs on a Canadian-hosted server; student data is stored in Canada.
- Daily backups are taken and retained on a rolling schedule; restore procedures are documented in our business continuity and disaster recovery plans.
- Network-level rate limiting and connection limits protect the platform from abusive traffic.
Third-party services
Three providers process limited data to deliver specific functions, and nothing else:
- Text-to-speech (ElevenLabs) receives only the text of a name to generate the pronunciation clip.
- Transactional email (Elastic Email) delivers invitations, PIN resets and confirmations to the graduate's address.
- Bulk email (Mailchimp) is used where an institution chooses it for invitation and reminder campaigns, using name and email only.
Email providers may process messages outside Canada. Institutions that need Canadian-only email delivery can raise it with us before onboarding.
How the software is built
- Purpose-built application with a small, reviewed codebase: no content-management system or plugin ecosystem to patch.
- All database access uses parameterized queries; all output is escaped. Uploads are validated by content, not file extension.
- Changes are reviewed and tested before deployment; production credentials never leave the server.
- Graduates install nothing. The presenter's desktop application authenticates with an administrator account and downloads only approved audio for its own ceremony.
Incidents and disclosure
If a security incident affects personal information, StageReader notifies the affected institutions without undue delay and supports their notification obligations under Canadian privacy law. If you believe you have found a vulnerability, email support@stagereader.ca with Security in the subject; we acknowledge reports promptly and do not pursue good-faith researchers.
What we do not claim
StageReader does not currently hold an independent certification such as SOC 2 or ISO 27001. The HECVAT describes our controls in detail so your team can assess them directly, and we are happy to walk through any answer on a call.
Request the HECVAT Read the privacy policy
Last updated: 2026-09-28