Security measures
Hosted on AWS
TutorialCool runs on Amazon Web Services (AWS) EC2. AWS's infrastructure is independently certified to ISO 27001, SOC 2, and PCI-DSS (certifications that apply to the AWS hosting layer).
Encryption in transit
All traffic is served over HTTPS/TLS. HTTP requests are automatically redirected to HTTPS, and HTTP security headers are enforced.
Encryption at rest
The AWS storage volumes (Amazon EBS) are encrypted, so stored data is encrypted at rest.
Access control
Administrative access is limited to authorized personnel from an authorized, biometrically secured workstation using key-based (SSH) authentication, following least privilege.
Network isolation
Application services run on internal-only ports behind a reverse proxy; inbound access is restricted by AWS Security Groups to only the ports required.
Logging & monitoring
Access and application logs are retained to support monitoring and incident investigation.
Patch management
Operating-system and application dependencies are updated on a regular basis.
Incident response
We maintain an incident response plan covering detection, containment, recovery, and notification of affected parties.
Compliance & certifications
TutorialCool does not currently hold its own third-party security certifications. It is pursuing Texas Risk and Authorization Management Program (TX-RAMP) Level 2 certification. A gap analysis against the TX-RAMP Level 2 (NIST SP 800-53 Moderate) baseline is in progress, and remaining items are tracked through a Plan of Action and Milestones (POA&M). The underlying AWS hosting layer is independently certified (ISO 27001, SOC 2, PCI-DSS), and AWS compliance reports are available through AWS Artifact.
Requesting security documentation
Texas state agencies, public institutions of higher education, and public community colleges may request TutorialCool security documentation (including a system overview with data inventory and data-flow description, a hosting and subprocessor list, an information security policy summary, and an incident response plan summary).
- Email support@tutorialcool.com with the subject "TX-RAMP documentation request – TutorialCool".
- Include the requesting organization, the requester's name and title, and the documents needed.
- We acknowledge requests within 2 business days and provide available documentation within 10 business days, by email to the verified requester.
Security Point of Contact, Chop Cost Consulting LLC
support@tutorialcool.com · 214-597-4848