Security at Perusall

  1. Overview. We take information security extremely seriously at Perusall. Our aim is to implement industry best practices and, wherever possible and convenient for our users, to improve on this state of the art.
  2. Security for Perusall Infrastructure. All student connections to Perusall servers are secured and encrypted with SSL. For additional security, the Perusall database is encrypted at rest. All of our server infrastructure is hosted in the cloud by companies that implement industry-standard practices for access management. Access to Perusall infrastructure is tightly controlled and available only to selected and trained Perusall staff, who use unique passwords and (where feasible) two-factor authentication to control access.
  3. Security for Personal Information. Access to student and instructor information is tightly controlled to comply with standard practice and applicable laws. Conversations inside the platform are made public to other members of the corresponding course (much in the same way in-class discussions would be public) but student grades are only made visible to the instructor (and the applicable student). When the instructor configures it, Perusall may be integrated into an institution’s Learning Management System (LMS), and when the LMS supports it the Perusall gradebook can be automatically synced back to the LMS in a secure manner. Except for the LMS and the use of Twitter, Google, or Facebook accounts to log into Perusall, Perusall’s authentication system is kept separate from all other related systems, including Perusall’s support and payment systems.
  4. Security for Publisher Content. The original media (such as PDFs or EPUBs) are stored securely, with access restricted to selected and trained Perusall staff. This original media is never distributed to students or anyone else. Students interact with publisher’s content through an HTML/Javascript interface and never access the original media directly. At the publisher’s sole option, students may be offered additional functionality, including limited options to copy to the clipboard or to print some portion of the book.
  5. Detecting Unauthorized Access. Perusall implements a number of measures to prevent unauthorized access and to prevent multiple students from sharing a login. When a student logs in, the user is logged out in all other browsers and devices that are currently logged in. Further, users viewing book content are logged out automatically after a period of inactivity, when required by the publisher. Perusall uses advanced analytics to flag user actions for review as potential abuse with regard to publisher-provided materials. Perusall will investigate and take appropriate action if any quantity exceeds the internal threshold.
  6. Access to Personally Identifiable Information. Only authorized, trained, and active (non-terminated) employees and contractors have access to personally-identifiable information. A partner must approve all access, and access is controlled through password or other secure access. Passwords must be selected randomly, changed at least every six months, and must be at least eight characters long consisting of one uppercase letter, one lowercase letter, one numeral and one symbol. Passwords may never be stored in plain text. Two-factor authentication is used wherever possible.
  7. Server Maintenance. When possible, servers are further secured by only opening ports that are required for the service, and whitelisting access by IP address or similar means. Servers are regularly patched to keep up-to-date.
  8. Incident Management. In the event of an incident that inappropriately discloses any customer data to unauthorized sources, the incident is fully investigated and documented, including the full scope of the disclosure and the result of a root cause analysis. Affected parties, including affected publishers, instructors, and students, will be notified as appropriate, and remedial measures taken to secure the data so disclosed. All partners will be notified of any security-related incident.
  9. Risk Assessment. Perusall periodically hires outside firms to evaluate our security infrastructure, conduct penetration tests, and provide consultation and advice. Perusall periodically reviews and assesses potential security and confidentiality risks, and ensures that our system and internal recordkeeping minimizes such risks. Only selected and trained Perusall staff can access personal data, and violation of our security policies can result in disciplinary action up to and including termination. Personal data must be stored electronically in encrypted form, and may not be transported in paper form. Terminated employees will have their credentials revoked immediately upon termination. Access credentials are periodically reviewed to ensure that no unused credentials are still active.
  10. Disaster Recovery. In the event of a natural disaster, Perusall will restore the database from the closest available point-in-time backup to minimize lost data. New virtual infrastructure will be provisioned on cloud providers as necessary, in an alternative geographical region if needed. Perusall will communicate any disaster event that requires recovery to the full list of registered users.