Security

Your most sensitive details are encrypted

Your SEVIS ID, EAD number, A-Number, passport number, I-94 number, date of birth, home address and signature image are encrypted by the application before they reach the database, using AES-256-GCM. The key lives separately from the database, so database access on its own reveals nothing.

They never leak out sideways

• Never in a web address, so they cannot end up in server logs or browser history.
• Never in application logs or crash reports — a redaction layer strips them first.
• Never in analytics.
• Never in an email. When you send a document to your DSO, we send a secure link that expires, not an attachment.
• Never in a prompt to an AI model.

Shared and library computers

We assume you might be on one. Sensitive fields are never written to browser storage, sessions time out, and there is a “this is a shared computer” option at sign-in that ends your session when you close the tab. Once saved, identifiers display masked, with a button to reveal them.

Only you can see your documents

Access is enforced in the database itself, not just in the application, so a bug in one layer does not expose another person’s file. When you share a link with your employer, it is scoped to the sections you chose, it expires, and you can revoke it. It never exposes your SEVIS ID or passport number.

Payments

Card details are handled entirely by Stripe and never touch our servers.

Reporting a vulnerability

Email security@optprep.com. We will acknowledge within 72 hours. Good-faith research is welcome — please test against your own account rather than someone else’s data.