Security & privacy

How copilotBC protects your records.

Last reviewed: August 12, 2026. Every protection described here is built and switched on today. Where a safeguard is narrower than its heading suggests, the narrower thing is what is written.

copilotBC is built so that your students' records are reachable only by you, and by a driving school you have both agreed to work with; those records can't be secretly altered or deleted; and the sensitive parts, signatures, lesson audio and payment cards, are handled with the strongest practical safeguards. Verified by adversarial security testing, not just promised.

1. Your data stays in Canada

Student records (names, licence details, lesson history, readiness scores, and reports) are stored in Google Cloud Firestore in the Toronto (northamerica-northeast2) region. This keeps personal information of BC learners on Canadian soil, which directly addresses data-residency expectations under British Columbia's Personal Information Protection Act (PIPA).

All data is encrypted at rest (Google-managed AES-256) and encrypted in transit (TLS 1.2+), automatically, on every read and write. We do not take or hold separate backup copies of the database ourselves; its durability is Google Cloud's, inside that region.

2. Who can see your students — enforced by the server, not the app

Every instructor's data lives in a private, isolated space keyed to their account. The rules that govern access run on Google's servers, not in the app on your device, so they can't be bypassed by tampering with the app, calling the database directly, or any other client-side trick.

The server independently checks, on every single request, that:

• you are signed in,
• your email is verified, and
• you are the owner of the exact record being touched.

We tested this the hard way, attempting to read, list, query, and write another instructor's records through every channel we could find, and every cross-instructor attempt was denied.

There is exactly one deliberate exception, and it only exists when you have agreed to it: a driving school you hold a seat with. Section 3 sets out what that means.

3. Driving schools: what an owner can see, and what they never can

copilotBC has a School plan, where one owner account pays for several instructors. BC's driver-training rules put the record-keeping duty on the school, so the school has to be able to reach the records created under its licence. That access is built to be narrow, consensual, and impossible to grant one-sidedly.

• Both sides have to agree. The owner sends a join link. You sign in to your own account, read what the school will be able to see, and press accept. No client of any kind can create a seat, an owner can only invite or remove, and activating a seat requires your own session and a verified email address that matches the invitation exactly. copilotBC never issues or holds an instructor's password on an owner's behalf.
• The owner's access is read-only. They cannot create, change or delete anything in your account.
• They never see your saved signature image, your driver's licence number, the e-transfer address you collect payments at, whether you consented to the optional AI features, or your payout configuration. Those live on a separate document that carries no school access, in any circumstances. Entries in your activity log about dismissing the inactivity lock are excluded too: when you unlocked your own phone is not a training record.
• What they can see, they can see all of, while the seat is live. That includes students, lessons and reports you recorded before you joined the school. We say so here, and the app says so on the screen where you accept the seat, because it is the sentence you are agreeing to.
• Records created under a school stay with the school. Students, lessons and reports created while you hold an accepted seat are stamped with that school's identity when they are created. The stamp can never be changed afterwards, by you or by anyone else, and the school keeps read access to those records after your seat ends. Work you did before joining carries no stamp and goes back to being yours alone.
• Reads are not logged. The activity log records changes to records, not who looked at them. Nobody can produce a list of when a school owner opened a file.

4. Strong account protection

• Verified-email sign-in. Email/password accounts must confirm their address before they can store or read any data, and so must student and parent portal accounts. Google sign-in is verified by Google. This blocks throwaway and automated accounts from ever touching the database.
• Google App Check (reCAPTCHA v3), enforced. Every request must carry a valid App Check token proving it came from the genuine copilotBC app rather than a script or a bot. This is enforced on both authentication and the database.
• Automatic sign-out after inactivity. Set your own window, 60 minutes by default, or turn it off. It is a walk-up protection for a device left on a passenger seat, not session revocation. It will not sign you out while there is unsynced work or you are offline: it locks the screen instead, so nothing is ever lost to it.
• Session hygiene. Signing out wipes your saved settings, any cached lesson audio, and the offline database copy from the device. This matters on shared or family computers.
• Two-step verification with an authenticator app. Optional, and switched on by the instructor from Settings, under Account and access. Your authenticator app produces a fresh six-digit code every thirty seconds, and copilotBC asks for one whenever you sign in again, so a stolen password on its own is not enough to get in. Once it is on, we show you a set of one-time recovery codes, once, and make you type one back before you can leave that screen, so nobody walks away from a protected account holding codes they never saved. Two things we deliberately do not do: we do not send codes by text message, because a phone number can be moved to someone else by persuading a mobile carrier, and there is no option to mark a device trusted and skip the check. A device that has been signed out is always asked again. Signing in with Google instead is protected by whatever second step you have set on your Google account.

5. Records can't be secretly changed or deleted

A driving-instruction record only has value if everyone can trust it wasn't altered after the fact. copilotBC enforces this at the database level:

• Signatures are permanent. Once a lesson is signed off, it is locked. It cannot be un-signed, its status cannot be rolled back, and its details cannot be rewritten.
• Signed records can't be deleted. BC's Motor Vehicle Act Regulations (Division 27) require training records to be retained for a period currently understood to be 6 years. copilotBC enforces that retention by refusing to delete a signed lesson. There is no override.
• Completed lessons can't be deleted either. Even a finished lesson that hasn't been signed yet already represents delivered instruction.
• Students are archived, never erased. Removing a student hides them from your active list but keeps every record intact behind them.
• Corrections are appended, never overwritten. The original text is never silently replaced. Every change is visible and attributable.
• Tamper-evident audit log. Consequential actions are written to an append-only audit trail that cannot be edited or deleted, not even by the account owner.

6. Trustworthy electronic signatures

copilotBC's in-person signature flow follows the two-party model recognised by British Columbia's Electronic Transactions Act (section 11): the instructor signs, then hands the device to the student, who types their full name and ticks explicit consent boxes while the instructor witnesses it.

For the scan-to-sign-on-your-own-phone option, each link is protected by a 192-bit cryptographically random token. It expires after 10 minutes (enforced on the server), can be used once only, and is deleted automatically once the signature is captured.

7. Hardened connections and infrastructure

• HTTPS everywhere, always. The app is served only over encrypted HTTPS.
• HSTS with preload. A 2-year Strict-Transport-Security header with subdomain coverage and preload instructs browsers to refuse insecure connections entirely.
• Strict Content-Security-Policy. A tight allow-list controls exactly which scripts, styles, fonts, images, and network destinations the app may use. No wildcard scripting, no inline-script execution, plugins disabled, and the page cannot be framed by another site (closing clickjacking).
• Defensive HTTP headers. X-Frame-Options: DENY, X-Content-Type-Options: nosniff, strict Referrer-Policy, and a locked-down Permissions-Policy.

8. Defence against malicious data and code injection

copilotBC defends in three independent layers:

1. Input is sanitised before it's ever stored. HTML-control characters and injection vectors are stripped.
2. The database validates the security-critical parts of every write on the server: who owns the record, what type it is, which status values are legal, the shape of every signature and consent, size limits on stored images and documents, and the immutability of anything already signed. Free text an instructor types into their own records is accepted without a per-field length check.
3. The app renders all text safely, using a framework that escapes content by default, with no use of dangerous code paths (eval, innerHTML, dangerouslySetInnerHTML).

Our third-party software dependencies are audited for published vulnerabilities, and advisories that affect the code we actually ship to the browser are patched.

9. Works offline, syncs safely

copilotBC is a Progressive Web App: it keeps working in a car with no signal and syncs automatically when you're back online. The same server-side security rules apply to every synced change: going offline never relaxes who can read or write what.

10. Privacy by design

• Lesson audio never leaves your device, and only exists with consent. Three things have to be true before a single second is recorded: recording is permitted (in a school, that is the school's decision, not the instructor's), the instructor has switched it on, and that student has signed a consent saying yes. Saying no is a complete answer and is never asked again. Transcription runs entirely in your browser, so audio is never uploaded to us or to anyone else. Recordings delete themselves after a window between 1 and 90 days, 30 by default, with no "keep forever" option. A student can withdraw at any time from their portal, and the audio is deleted the next time the instructor opens the app. The written notes already saved stay, because those are part of the training record.
• No payment-card exposure. Payments are processed by Stripe on a Stripe-hosted checkout page (the PCI DSS SAQ-A model): no card form ever renders inside copilotBC, no payment script loads in the app, and copilotBC never receives, processes, or stores card numbers. Payment state is written only by our payment server after Stripe cryptographically confirms the charge — the app itself can't forge a "paid" record.
• Data minimisation. We collect only what a BC driving instructor genuinely needs for instruction and regulatory record-keeping.
• Your rights, built in. copilotBC supports exporting a student's full record, an append-only correction trail, and retention controls aligned to the regulatory window. The export is one student at a time, from the account that holds that record.
• Ending a plan doesn't delete anything. When a subscription ends, access to the app ends with it and signing in takes you to the plan page. Your records are not touched: signed training records stay retained, and resubscribing puts everything back in front of you.

11. We test ourselves — adversarially

copilotBC is put through adversarial security testing: deliberate attempts to break in without an account, read or modify another instructor's data, forge or delete signed records, inject malicious content, and abuse the system to run up costs. When a test surfaces a gap, we aim to fix it promptly and re-verify before shipping. To be clear about what this is and is not: these are our own reviews. copilotBC does not hold a third-party security certification such as SOC 2 or ISO 27001.

Security questions: [email protected]