Last updated: 1 October 2026

Security & trust

BeSure checks what AI assistants tell families about your school and gives your web team the exact words to change. It is built to need almost nothing from you.

1. 01

   We never touch your website

   No login to your systems. No code, no plugin, no tracking tag. Your web team makes every change themselves, like any content request from marketing.

2. 02

   We read only public information

   • What ChatGPT, Claude, Gemini, Perplexity, and Google’s AI Overviews and AI Mode answer to the questions families ask. Anyone can ask them.
   • Up to 25 public pages of your website, the way a search engine does. Our reader identifies itself as BrainforestAEO and follows your robots.txt.
3. 03

   No student data

   We never receive student records, applicant data or anything from your student systems. There is no student data here for FERPA to cover.

4. 04

   What we store

   • Your email address. If you choose a password, we keep only a scrambled (hashed) copy.
   • Payments are handled by Stripe. We never see or store your card number.
   • The email address you enter for your web team, and your name if you add it.
   • Facts about your school that you confirm. These are public facts, like your city and your programs.
   • The AI answers we collect, and the changes we write.
   • IP addresses, briefly, to limit abuse and in server logs.

   We do not sell data, show ads or use advertising trackers.

5. 05

   Only your school can act for your school

   • To see or act for a school, you confirm an email on that school’s domain (for example, [email protected]) from your inbox. Only confirmed people at that school can see its Scorecard.
   • Sign-in links work once and expire in 24 hours.
   • Agencies working for a school are approved by us by hand.
   • One owner per school. The owner pays, sends changes and edits facts. Colleagues can view.
   • Changes can only be sent to a web team email on your school’s domain, at most five times a day.
   • Sign-in attempts are limited, and password-reset links work once and expire in an hour.
6. 06

   How it sits with your web team

   • Nothing to approve or install. Your web team receives one email with text edits and chooses whether to make them. Your site stays in your control.
   • Our email may land in spam the first time. You can also forward it yourself.
   • Your procurement team may send a security questionnaire, such as the HECVAT. We are happy to complete it. It is short, because we hold almost no data.
7. 07

   Where it runs

   • Hosted on DigitalOcean in London, UK, with a managed database.
   • Encrypted connections (HTTPS) everywhere, with modern browser security settings.
   • Secret keys are kept outside the code. We get alerts about security updates to the software we use.
8. 08

   Services we use

   Service	What for	What it receives
   DigitalOcean	hosting and database	everything above
   Anthropic (Claude)	asking questions, grading answers, writing changes	questions about your school, the AI answers, public facts and page text
   OpenAI (ChatGPT)	asking questions	questions about your school
   Google (Gemini)	asking questions	questions about your school
   Perplexity	asking questions	questions about your school
   DataForSEO	asking Google’s AI Overviews and AI Mode	questions about your school
   Resend	sending email	your email and your web team’s email
   Stripe	payments	the owner’s email, billing name and address, payment status (card details are entered on Stripe, never seen by us)

   We send no personal data to the AI services. They only receive questions about your school, the AI answers about it, and public facts and text from your website.

9. 09

   Questions or a security issue

   Email [email protected]. We reply within two working days. Read our Privacy policy and Terms.