Trust and architecture
Data boundaries are part of the product design
Student annotations remain separate from source PDFs, teacher guidance uses a separate layer, and public analytics never load inside private workflows.
Classroom work stays in authenticated workflows
Student sessions, annotations, selected evidence, and typed responses are available only through authorized classroom and teacher-review routes. Private pages emit noindex crawler controls.
Public analytics stay on public pages
When Google Analytics is configured, it is rendered only on public marketing and legal pages. Student, reader, teacher, administrator, billing, demo, and API routes do not load the tag.
PDF bytes use one storage boundary
PDF metadata remains in PostgreSQL while bytes may use database or object storage. Upload, download, deletion, and compensation flows use the shared storage service rather than direct route access.