1. BYODB — student data never leaves your infrastructure
When Canvas was breached in May 2026, 275 million student records were exposed because they were all stored on Canvas's servers. Under SetFlow's BYODB architecture, an attacker who breached SetFlow would find encrypted connection strings — not student records. Student data lives in your database, not ours.
Each institution provisions a PostgreSQL-compatible database in its own environment, and SetFlow connects to it via a private network connection. Durable student records — names, emails, grades, assignments, messages — live in the institution's database. SetFlow holds only institution configuration, billing, and an encrypted connection string.
AES-256-GCM encrypted connection strings. Decrypted in memory only for the duration of each request, then zeroized. The decrypted value never touches the filesystem, never enters a log, and never leaves the process.
Scrypt key derivation. No raw secrets are stored. Keys are derived from a master secret using a memory-hard function that makes brute-force attacks computationally infeasible.
Authenticated encryption. AES-GCM is authenticated encryption — a tampered ciphertext is detected and rejected. Decryption throws; there is no silent fallback to a shared database.
Key revocation. Institutions that hold their own encryption keys retain unilateral revocation. A key rotation on your side instantly makes SetFlow's stored ciphertext useless.
What an attacker gets if SetFlow is breached, under BYODB:
✓ Has access to: Encrypted connection strings (useless without the key). SetFlow's application source code (we publish much of it anyway).
✗ Cannot access: Student names. Student emails. Student IDs. Grades. Assignments. Conversation history. Accommodation data. Any student personally identifiable information whatsoever.
For the architecture write-up, see our BYODB documentation and the SSRN paper at papers.ssrn.com/sol3/papers.cfm?abstract_id=6798778.